Oracle Coherence CVE-2026-60252

Exploitation requires network TCP reach to an affected Oracle Coherence instance (cluster port or Coherence*Extend proxy listener) running version 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0; per the vector PR:N/UI:N/AC:L no authentication, no user interaction and no special configuration are needed against a reachable instance. The primary limiting factor is network exposure: Coherence is normally deployed on internal application-tier networks, so realistic risk depends on whether the cluster/Extend ports are exposed beyond trusted hosts. Impact is limited to availability (denial of service) - no data disclosure or code execution.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a genuinely low-barrier attack: network reachable, low complexity, no privileges and no user interaction, with high availability impact but no confidentiality or integrity effect. This makes it a real priority for internet- or intra-cluster-exposed Coherence deployments, but the impact ceiling is a denial of service only - there is no data compromise or code execution, so it should be triaged below any co-published RCE in the same Oracle CPU. No EPSS score, KEV listing, or POC was provided; absence of these signals suggests exploitation is not yet observed or automated at scale, though Oracle explicitly rates it 'easily exploitable,' which raises the practical likelihood if the service is exposed. No conflicting signals are present: description, tags (Denial Of Service) and the A:H-only vector all agree this is a DoS.

An attacker who can reach a Coherence cluster or Extend proxy TCP port sends a crafted or malformed request over the network, without any credentials, causing the Coherence process to hang or repeatedly crash and taking the data grid offline. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network access and low effort and no user interaction; no public proof-of-concept has been identified at time of analysis.