Oracle Coherence CVE-2026-60251

The only prerequisite is TCP network reachability to an Oracle Coherence Core/cluster or proxy (Extend) listener on an affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0); per the CVSS vector AV:N/AC:L/PR:N/UI:N there is no authentication, no user interaction, and no special configuration required - this is remote unauthenticated exploitation against default-reachable Coherence services. The primary limiting factor is network exposure: Coherence is typically deployed on internal application tiers, so exploitation depends on the attacker having a path to the cluster/proxy ports (internet-facing or flat-network deployments are at highest risk, while installations with the ports firewalled to a trusted segment are substantially harder to reach). Version is also limiting - only the four listed supported versions are confirmed affected.

All available signals point to genuine high priority rather than an inflated CVSS. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes remote, low-complexity, unauthenticated exploitation with full triad impact, and Oracle explicitly labels it 'easily exploitable' and resulting in 'takeover' - the vendor's own qualitative language reinforces the numeric score. No EPSS score was provided in the input, and the vulnerability is not in CISA KEV, so there is no evidence of active exploitation yet; likewise no POC was supplied, so exploitation is currently theoretical. One inconsistency to verify: the Tags field lists 'Information Disclosure,' which understates the impact - the description and CVSS both indicate full confidentiality, integrity, and availability compromise (takeover), so treat the tag as incomplete metadata, not a scope limiter. Given the trivial exploitation profile of an internet- or intranet-reachable middleware service, defenders should assume weaponization is feasible once details circulate and patch on an accelerated timeline despite the absence of current in-the-wild activity.

An attacker who can reach a Coherence cluster or proxy TCP port from an adjacent network segment or the internet sends a crafted request to the exposed Core service and, without any credentials or user interaction, achieves full compromise of the Coherence process. Because Oracle rates it 'easily exploitable' with AC:L, a single unauthenticated network interaction is sufficient to take over the node and, by extension, the cached application data and cluster it serves. No public POC has been identified at time of analysis, so this scenario is inferred from the CVSS vector and vendor description rather than an observed exploit.