Oracle Coherence CVE-2026-60247

No special conditions - remote unauthenticated exploitation over HTTP against default configurations of Oracle Coherence, per the CVSS vector AV:N/AC:L/PR:N/UI:N and Oracle's 'easily exploitable' characterization. The primary limiting factor is network reachability: the attacker must be able to reach a Coherence HTTP/listener port, so instances that are network-segmented, firewalled, or bound only to internal cluster interfaces are substantially harder to attack. Exploitation is scoped to supported versions 12.2.1.4.0 and 14.1.1.0.0; other versions are not named in the source data.

All CVSS signals point to maximum severity: AV:N/AC:L/PR:N/UI:N means a remote, unauthenticated attacker can exploit it over the network with low complexity and no user interaction, and C:H/I:H/A:H yields a 9.8 base score with full impact. Oracle explicitly calls it 'easily exploitable,' reinforcing the low-complexity rating. However, no EPSS score, no POC, and no KEV listing are present in the provided data, so real-world exploitation probability cannot be quantified and there is currently no evidence of active exploitation - the priority rests on the intrinsic ease of exploitation and the sensitivity of middleware data grids rather than on confirmed attacker interest. Note a minor inconsistency: the intelligence tags include 'Information Disclosure,' but the description and CVSS (I:H/A:H) describe full takeover, so treat this as a complete-compromise issue, not merely disclosure.

An attacker who can reach a Coherence HTTP listener from the network sends a crafted request to the Core component and, without any credentials or user interaction, triggers the flaw to achieve full control over the Coherence instance and its in-memory data. Because Oracle rates it easily exploitable with low attack complexity, mass scanning of exposed middleware ports could rapidly identify vulnerable 12.2.1.4.0 and 14.1.1.0.0 hosts, though no public exploit is identified at time of analysis.