Oracle Coherence CVE-2026-60271

Exploitation requires the attacker to already possess a low-privileged account with logon access to the infrastructure host where Oracle Coherence executes (CVSS PR:L, AV:L) - it cannot be triggered remotely over the network. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once local access is held the attack is reliable. Limiting factors: the mandatory pre-existing local foothold, applicability only to Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and the absence of any network-facing exposure.

The CVSS 3.1 base score is 7.8 (High), driven by full C/I/A impact but constrained by AV:L (local attack vector) and PR:L (a pre-existing low-privileged account on the Coherence host). AC:L and UI:N mean that once local access exists, exploitation is reliable and requires no victim interaction, which is why Oracle rates it 'easily exploitable.' However, the local-only vector materially lowers real-world urgency compared to a network-exploitable RCE: an attacker must already have a foothold on the infrastructure. No EPSS score, SSVC decision, KEV listing, or POC was provided, so there is no evidence of active or imminent exploitation - this reads as a patch-in-normal-cycle priority rather than an emergency, though the C/I/A takeover impact warrants prompt attention on internet-adjacent or multi-tenant Coherence hosts. Note the 'Information Disclosure' tag under-represents the actual impact, which the vector shows extends to integrity and availability (full takeover).

An attacker who has obtained a low-privileged local account on a server running Oracle Coherence - for example via a compromised application service account or a prior foothold - leverages the Core component flaw to escalate to full control of the Coherence process. This grants read/modify access to cached data and the ability to disrupt the data grid. No public POC was provided at time of analysis.