Oracle Coherence CVE-2026-60265

Exploitation requires: (1) local logon access to the infrastructure host where Oracle Coherence is executing (AV:L - remote network exploitation is not possible), and (2) a high-privileged account on that infrastructure (PR:H - an unprivileged or low-privileged user cannot trigger this vulnerability). No special non-default configuration of Oracle Coherence has been identified as required beyond a standard installation of an affected version. The limiting factors are the local access requirement and the high privilege prerequisite, which together confine exploitation to insider threats, privileged administrators acting outside their authorization, or post-compromise scenarios where an attacker has already achieved high-privileged local access. The 'Authentication Bypass' tag suggests the flaw allows crossing of data access boundaries from a position of existing privilege, not entry from an unauthenticated state. No user interaction is required once the attacker has the necessary local high-privileged session.

The CVSS 3.1 base score of 6.0 is driven by a scope change (S:C) combined with high confidentiality impact (C:H), but is materially constrained by the local attack vector (AV:L) and high privilege requirement (PR:H). In practical terms, this means exploitation requires an attacker who already has an authenticated, high-privileged session on the host running Oracle Coherence - an insider threat or an attacker who has already achieved significant foothold. There is no KEV listing confirming active exploitation and no POC has been identified, making opportunistic exploitation unlikely. EPSS data was not provided in the source intelligence, so probabilistic exploitation likelihood cannot be quantified. The 'Authentication Bypass' tag creates a notable tension with PR:H: the tag suggests the vulnerability bypasses authentication or authorization controls, yet a high privilege prerequisite must first be met - this is consistent with a privilege-boundary crossing (e.g., a high-privileged Coherence operator bypassing data isolation controls), not a public-facing unauthenticated flaw. The scope change is the most consequential risk amplifier - a compromise of one Oracle Coherence instance could expose data in adjacent Oracle Fusion Middleware products. Overall, this is a real but narrow-impact vulnerability: low probability of external exploitation, moderate consequence if an insider or post-compromise attacker is present.

An attacker with an existing high-privileged account on the host infrastructure running Oracle Coherence - such as a DBA, Coherence administrator, or an adversary who has already escalated privileges on the system - exploits the Core component flaw to bypass data access controls and reads all data within the Coherence cache, including sensitive application data. The scope change means the attacker may then pivot to read data accessible to co-deployed Oracle Fusion Middleware components on the same infrastructure. No public exploit code exists at time of analysis, so exploitation requires knowledge of the specific flaw in the Core component.