Oracle Coherence CVE-2026-60250

The attacker needs TCP network reachability to an Oracle Coherence listener (cluster member or Coherence*Extend proxy port) on an affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0). Per the CVSS vector AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special configuration are required against a reachable node. The primary limiting factor is network exposure: Coherence data-grid ports are typically intended for internal/back-end segments, so exploitation is constrained to attackers who can route to those ports - deployments that firewall Coherence off from untrusted networks materially reduce real-world reachability.

The signals point to genuine high priority rather than inflated CVSS. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H (9.8) indicates remote, unauthenticated, low-complexity exploitation with full CIA impact, and Oracle explicitly labels it 'easily exploitable' and resulting in product 'takeover.' Counterbalancing this: there is no EPSS score, no POC, and no CISA KEV entry in the provided data, so there is currently no evidence of active or automated exploitation - the risk is potential, not yet observed. Note a minor inconsistency: the tags list 'Information Disclosure,' but the description and CVSS (I:H/A:H) describe full compromise, not mere disclosure; the CVSS and Oracle narrative should be treated as authoritative over the tag. Overall this is a real patch-now issue for internet- or broadly-network-exposed Coherence nodes.

An attacker who can reach a Coherence cluster or Coherence*Extend proxy TCP port sends a crafted request/object to the exposed listener without any credentials, exploiting the Core flaw to gain control of the node. Because Oracle rates it 'easily exploitable' with low attack complexity and no authentication, a single reachable port is sufficient to achieve takeover; no public POC is available at time of analysis.