Oracle Coherence CVE-2026-60266

Exploitation requires network-level access to an Oracle Coherence cluster endpoint communicating via TLS - the attack is specifically described as occurring 'via TLS', meaning the TLS listener must be reachable by the attacker. No authentication credentials are required (PR:N). No user interaction is needed (UI:N). The attack complexity is High (AC:H), meaning exploitation is not reliably repeatable without specific conditions aligning - these conditions are not publicly detailed but are intrinsic to the vulnerability in the Core component. Deployments where Coherence cluster ports are isolated behind firewalls to only trusted application-tier hosts are substantially protected; the key limiting factor is network reachability of the TLS endpoint from an untrusted network segment. All four supported version branches (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) are affected regardless of whether default or custom TLS configurations are in use.

The vendor-assigned CVSS 3.1 score of 5.9 (Medium) is primarily dampened by AC:H, meaning exploitation requires conditions beyond a simple network connection - specific timing, state, or TLS configuration alignment must hold. The unauthenticated network vector (AV:N/PR:N/UI:N) raises the real-world threat surface: any Coherence cluster with its TLS port reachable by an adversary is theoretically in scope, without requiring credentials. The confidentiality impact is maximum (C:H) with zero integrity or availability impact, meaning an attacker gains read access to all cached data but cannot modify or disrupt the cluster. No EPSS score is provided in source data; exploitation probability cannot be numerically assessed. The absence of a CISA KEV listing and lack of public POC reduce immediate exploitation likelihood, but the AC:H rating implicitly suggests a capable attacker - nation-state actors or well-resourced groups targeting Oracle-heavy enterprise environments - could potentially achieve exploitation. This is not a trivially exploitable mass-scan vulnerability, but it is a meaningful risk for organizations storing sensitive data in Coherence grids with TLS endpoints reachable from untrusted segments.

An attacker with network-level access to a Coherence cluster's TLS listener sends a crafted protocol sequence that exploits the authentication bypass in the Core component, satisfying the specific conditions required by the AC:H rating (such as a particular TLS state or protocol timing window). Upon bypassing authentication, the attacker gains the ability to issue read queries against the Coherence data grid, exfiltrating all cached application data - which in enterprise deployments may include session tokens, PII, financial records, or application configuration secrets. No public exploit code exists at time of analysis, so this attack would require original research or an undisclosed private tool.