Oracle Coherence CVE-2026-60263

Exploitation requires network TCP reachability to an affected Oracle Coherence service (Core component) running version 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 - the attacker must be able to open a connection to the Coherence cluster or proxy listener. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special product feature toggle is stated as required, so default network-reachable deployments are exposed. The key limiting factor is network placement: if Coherence TCP ports are confined to an isolated internal or management network behind firewalls, an external attacker cannot reach the service, sharply reducing real-world exploitability despite the unauthenticated, low-complexity profile.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N describes a low-barrier attack: network reachable, low complexity, no privileges, no user interaction, with high confidentiality impact but no integrity or availability effect. Oracle explicitly labels it 'easily exploitable,' consistent with AC:L/PR:N, which raises real priority for internet- or broadly-network-exposed Coherence clusters. Countervailing signals: no EPSS probability, no CISA KEV listing, and no public POC are present in the provided data, so there is currently no evidence of active or automated exploitation - the score reflects potential rather than observed abuse. Realistic risk is therefore high for exposed deployments but substantially mitigated in the common case where Coherence cluster ports are confined to trusted internal networks; the practical priority hinges on network exposure of the Coherence TCP listeners.

An attacker who can reach a Coherence cluster or proxy TCP port from the network connects without credentials and queries the grid, retrieving cached application data such as session state, keys, or business records. No user interaction or prior foothold is needed, and because impact is confidentiality-only the intrusion may leave data intact and be harder to detect. No public POC is identified in the available data, so this is a plausible scenario derived from the CVSS vector rather than a demonstrated exploit.