Oracle Coherence CVE-2026-60254

Exploitation requires only TCP network access to a listening Oracle Coherence endpoint (cluster TCMP or Coherence*Extend proxy port); the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication and no user interaction are needed, so this is effectively remote unauthenticated exploitation against reachable Coherence instances among supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The primary limiting factor is network reachability: Coherence ports are frequently confined to internal application tiers rather than internet-exposed, so realistic risk is highest where cluster/proxy ports are accessible from untrusted networks. No specific non-default feature toggle is named in the description as a precondition, so the exposure is the presence of a network-reachable, unpatched Coherence listener.

All available signals point to genuine high priority rather than an inflated CVSS. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H combines network reach, low complexity, no privileges and no user interaction with high impact across all three properties, and Oracle explicitly labels it 'easily exploitable' with 'takeover' as the outcome. Counterbalancing this, no EPSS score, SSVC decision, POC, or KEV entry is present in the input, so there is no public evidence of active exploitation or automation yet - exploitation status is 'no public exploit identified at time of analysis.' One inconsistency worth flagging: the Tags label this 'Information Disclosure,' but the description and C:H/I:H/A:H vector describe full compromise, so the tag understates real impact and should not be relied upon. Given a pre-auth network takeover in enterprise middleware, absence of a POC should be treated as a timing gap, not as low risk.

An attacker who can reach an exposed Oracle Coherence cluster or Extend proxy port over TCP sends a crafted request to the listener without any credentials, leveraging the low-complexity flaw to gain control of the Coherence process. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H, this yields full takeover - reading and tampering with cached data and executing in the middleware context - with no user interaction. No public POC is identified at time of analysis, so a working exploit would currently require independent development.