Oracle Coherence CVE-2026-60249

Exploitation requires the attacker to have access to the physical/logical communication segment attached to the hardware where Oracle Coherence executes (AV:A) and to hold low-level privileges (PR:L) - it is not remotely exploitable from an arbitrary internet host and not fully unauthenticated. The exact affected feature is the Coherence Core component's inter-node/cluster communication as it runs in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No user interaction is needed (UI:N) and complexity is low (AC:L), so once segment access and low privileges are obtained, exploitation is straightforward. The primary limiting factors are therefore network adjacency (the cluster communication segment must be reachable) and the requirement for some existing privilege; organizations that strictly isolate their Coherence cluster network materially reduce exploitability.

The CVSS 3.1 score of 9.0 is driven by full Confidentiality, Integrity, and Availability impact (C:H/I:H/A:H) combined with a scope change (S:C), which is why an already high score is elevated to Critical. However, two metrics meaningfully constrain real-world risk: the attack vector is Adjacent (AV:A), not Network, so the attacker must already have access to the physical/logical segment carrying Coherence cluster traffic; and Privileges Required is Low (PR:L), so some level of access is needed rather than fully anonymous exploitation. Attack Complexity is Low (AC:L) and no user interaction is required (UI:N), so once an attacker is on the correct segment, exploitation is described by Oracle as 'easily exploitable.' No EPSS score, SSVC decision, KEV listing, or public POC was provided in the input, so exploitation likelihood cannot be quantified from the data available - this appears to be a newly disclosed CPU vulnerability with no evidence of active exploitation. Net assessment: a genuine high priority for organizations running Coherence clusters where the cluster network is not strictly isolated, but the AV:A/PR:L requirements make blind, internet-wide mass exploitation unlikely.

An attacker who has gained a foothold on the internal network segment carrying Oracle Coherence cluster traffic - for example via a compromised application server or a low-privileged internal account - sends crafted messages to the cluster's communication endpoint. Because Attack Complexity is Low and no user interaction is required, the attacker leverages the flaw to take over the Coherence instance and, due to the scope change, pivots to impact additional co-located Fusion Middleware components. No public exploit code was identified at time of analysis, so this scenario is inferred from the CVSS vector rather than an observed exploit.