Oracle Coherence CVE-2026-60268

Exploitation requires TCP network reachability to an affected Oracle Coherence Core service (cluster or Coherence*Extend proxy listener) plus a low level of existing privilege (CVSS PR:L) - it is not a fully unauthenticated, zero-prerequisite flaw. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors that reduce real-world exposure: the target must run one of the specific supported versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0), the attacker must reach Coherence's network ports (which in well-segmented deployments are internal-only), and the attacker must possess the low-privilege access the vector assumes; Coherence grids firewalled to trusted tiers and enforcing authentication/TLS materially raise the bar.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) indicates a network-reachable, low-complexity flaw needing only low privileges and no user interaction, yielding total loss of confidentiality, integrity and availability - Oracle explicitly rates it 'easily exploitable' and describes full 'takeover.' Counterbalancing this, the supplied intelligence contains no EPSS score, no SSVC data, no CISA KEV listing, and no public POC, so there is no evidence of active or widespread exploitation yet. The realistic priority is therefore high on a patch-management basis (trivial exploitation once weaponized, and Coherence often holds sensitive application state) but not an emergency based on confirmed exploitation. One caveat to verify: the vector requires PR:L (some valid low-privilege access), so real exposure hinges on whether Coherence cluster/proxy ports are reachable by semi-trusted actors - internal or DMZ exposure sharply raises risk, while well-segmented grids reduce it.

An attacker holding low-privilege network access to an internal or DMZ segment locates an exposed Oracle Coherence cluster or Coherence*Extend TCP proxy port and sends a crafted request to the Core service to trigger the flaw, achieving full takeover of the Coherence instance and the sensitive cached data it holds. Because Oracle rates it 'easily exploitable' (AC:L, no user interaction), a reliable exploit would need little sophistication once developed. No public exploit is identified at this time, so this scenario remains theoretical rather than observed.