Oracle Coherence CVE-2026-60267

Exploitation requires network reachability to an Oracle Coherence service endpoint (cluster or Extend/TCP-proxy) over TLS; per CVSS PR:N/UI:N no credentials and no user interaction are needed, matching the Authentication Bypass tag. The affected deployment must run one of Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0. The primary limiting factor is exposure rather than configuration: Coherence ports are often bound to internal/segmented networks, so realistic risk hinges on whether the Coherence listener is reachable by the attacker; deployments that already enforce network segmentation, mutual-TLS client authentication, or Coherence authorization on Extend/cluster traffic substantially raise the bar.

This is a genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) describes network-reachable, low-complexity exploitation requiring no privileges and no user interaction, yielding full confidentiality and integrity loss - consistent with the Authentication Bypass tag and Oracle's 'easily exploitable' language. Availability is scored N, so this is a data-exposure and data-tampering issue, not a denial-of-service. Mitigating the urgency: no EPSS score, no KEV listing, and no POC were provided, so exploitation is currently theoretical/vendor-reported rather than observed - active exploitation is not confirmed. No SSVC decision data was supplied. The main uncertainty is exposure: Coherence cluster/management ports are frequently deployed on internal or segmented networks, so real-world reachability of AV:N depends heavily on whether the Coherence service is exposed beyond a trusted network segment - verify network exposure before assuming internet-facing risk.

An attacker who can reach an exposed Oracle Coherence Extend/proxy or cluster endpoint over the network connects via TLS and, exploiting the authentication bypass, joins or queries the data grid without credentials. From there they read sensitive cached application data and create, modify, or delete grid entries, corrupting critical data used by the front-end applications. No public POC was identified at time of analysis, but the low attack complexity and no-authentication requirement make weaponization straightforward for a knowledgeable attacker.