Oracle Coherence CVE-2026-60256

The only prerequisite established by the data is network TCP reachability to an Oracle Coherence node running 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and no elevated privileges are required against a reachable instance. The practical limiting factor is exposure: Coherence cluster and Extend proxy ports are frequently bound to internal or backend networks, so an attacker must already have a network path to those TCP listeners. There is no indication a non-default configuration is needed; exploitation targets the Core component as deployed. Defenders whose Coherence ports are firewalled to trusted segments materially reduce realistic risk despite the 9.8 score.

The signals are consistent and point to genuine high priority rather than an inflated CVSS score: the vector AV:N/AC:L/PR:N/UI:N gives network reach, low complexity, no privileges, and no user interaction, while C:H/I:H/A:H reflects a total compromise. Oracle itself characterizes the flaw as 'easily exploitable' and resulting in 'takeover,' reinforcing the raw CVSS. However, no EPSS score was provided, there is no POC in the supplied data, and it is not in CISA KEV, so exploitation is presently theoretical - the absence of an EPSS value means widespread-exploitation likelihood cannot be quantified from this input. One inconsistency to note: the intelligence tags include 'Information Disclosure,' but the CVSS and Oracle wording describe full takeover with I:H/A:H, so the tag appears to understate impact and should not be relied upon. Scope is Unchanged (S:U), meaning compromise is bounded to the Coherence process/host rather than automatically pivoting to other security authorities.

An attacker who can reach a Coherence cluster or Extend proxy TCP port sends a crafted request/object to the exposed listener without any credentials, exploiting the Core component to gain code execution or full control of the Coherence instance. Given AC:L and PR:N, the attack needs no special timing, privileges, or user interaction. No public POC is present in the supplied data, but the low-complexity unauthenticated profile makes reliable exploitation plausible once details emerge.