Oracle Coherence CVE-2026-60260

HTTP network access to an Oracle Coherence instance running version 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 is the sole prerequisite; no authentication, user interaction, or special configuration is required per CVSS vector AV:N/AC:L/PR:N/UI:N. Exploitation is bounded to read access on a subset of data accessible through the Coherence HTTP interface - integrity and availability are not impacted. The primary limiting factor is network exposure: deployments where Coherence HTTP ports are not reachable from untrusted networks (e.g., isolated behind internal firewalls, VPN-only access, or not running the HTTP management interface) are not exploitable remotely. There is no indication that a non-default configuration is required to expose the vulnerable surface.

The CVSS 3.1 score of 5.3 (Medium) appropriately reflects the limited blast radius: the attack is network-exploitable, requires no authentication, and involves no complexity (AV:N/AC:L/PR:N/UI:N/S:U), but impact is bounded to partial confidentiality (C:L) with no integrity or availability consequences. This pattern - easy to reach, hard to weaponize for catastrophic damage - characterizes a moderate-priority finding in most environments. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. The 'Authentication Bypass' tag is the key risk amplifier: if Oracle Coherence HTTP endpoints are exposed to untrusted networks, automated scanners could harvest cached or in-memory data at scale. Environments with Coherence strictly on internal networks behind firewall rules face materially lower risk. The absence of a CWE is a minor data gap but does not affect the confidence in the impact boundary established by the CVSS vector.

An unauthenticated attacker who can route HTTP requests to an exposed Oracle Coherence instance running an affected version sends crafted HTTP requests to the Core component's data-access interface, bypassing authentication controls and receiving cached or stored data in the response. Because AC:L and PR:N apply, this requires no special setup and could be scripted for automated data harvesting. No public exploit code has been identified at time of analysis.