Oracle Coherence CVE-2026-60269

No special conditions - remote unauthenticated exploitation over TCP against Oracle Coherence, per Oracle's 'easily exploitable' assessment and the AV:N/AC:L/PR:N/UI:N vector. The concrete prerequisite is network reachability to a Coherence cluster member or Coherence*Extend proxy TCP listener; exploitation is limited only where those ports are firewalled off from the attacker or the deployment exposes no reachable Core/proxy listener. Affected versions are limited to 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, so releases outside that list fall outside the stated scope.

All available signals point to genuine priority rather than an inflated CVSS. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity, unauthenticated attack with unchanged scope but full C/I/A compromise, and Oracle itself labels it 'easily exploitable.' Countervailing signals: this is not on CISA KEV and no proof-of-concept is referenced, so there is no confirmation of active or public exploitation, and no EPSS score was supplied to gauge exploitation probability. There is also a data conflict worth flagging: the source Tags list 'Information Disclosure' only, whereas the CVSS vector and description assert full integrity and availability impact plus complete takeover - treat the tag as an incomplete label and defer to the CVSS/description, but verify scope with Oracle. No SSVC decision data was provided. Net: a high-severity, low-friction, unauthenticated network vulnerability in enterprise middleware - patch promptly even without in-the-wild reports.

An attacker who can reach a Coherence cluster member or Extend proxy TCP port from the network sends a crafted request to the Core communication endpoint, requiring no credentials and no user interaction. Because the flaw yields full takeover, the attacker gains control over the data grid - reading and modifying cached data and executing attacker-controlled logic in the Coherence process. No public proof-of-concept is currently identified, but the low attack complexity makes reliable exploitation plausible once details emerge.