Oracle Coherence CVE-2026-60257

The attacker only needs TCP network access to an exposed Oracle Coherence Core listener (cluster or Coherence*Extend proxy port) on an affected release (14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0); no authentication, no privileges and no user interaction are required (PR:N/UI:N), matching Oracle's 'easily exploitable, unauthenticated' description. What limits exploitation in practice is network reachability: Coherence listeners are typically bound to internal application tiers, so an attacker must be able to route TCP to the listener - deployments that firewall Coherence ports to trusted hosts substantially raise the bar, while any Coherence instance with a listener exposed to untrusted networks is directly at risk under its default posture.

All available severity signals align toward high priority: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H gives network reachability, low complexity, no privileges and no user interaction, with total impact to all three security properties and a 9.8 base score. Oracle explicitly calls it 'easily exploitable,' reinforcing the AC:L rating. Countervailing context is the absence of corroborating exploitation data - no EPSS score, no KEV listing, and no public POC were provided, so there is no evidence of active or automatable exploitation yet; an SSVC decision cannot be fully computed because exploitation status is 'none observed' from the supplied data. The realistic read is a genuine critical-severity issue whose real-world exploitation is currently unproven but whose preconditions (unauthenticated, network, low complexity) make weaponization plausible once technical details or a patch diff circulate. No conflicting signals were detected between the CVSS vector and the description; both indicate remote unauthenticated access.

An attacker with TCP reachability to a Coherence cluster or extend proxy listener sends a crafted request to the Core service and, without any credentials or user interaction, drives it to full compromise ('takeover') of the Coherence process and the data grid it hosts. Given the low attack complexity Oracle assigns, a single network-facing request could be sufficient. No public exploit code was identified at time of analysis, so this scenario is derived from the CVSS vector and Oracle's description rather than an observed exploit.