Oracle Coherence CVE-2026-60273

Exploitation requires network TCP reachability to an Oracle Coherence Core listener (cluster member or Extend/proxy port) running an affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0); no credentials (PR:N) and no user interaction (UI:N) are needed. The key limiting factor is high attack complexity (AC:H): the attacker must satisfy conditions outside their direct control - such as winning a race, defeating an existing protection, or hitting a specific serialization/cluster state - so exploitation is not reliably repeatable against a default install. Realistic risk is therefore concentrated where Coherence cluster/Extend ports are exposed beyond a tightly controlled trusted network.

The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1 High) signals a serious but non-trivial threat: no authentication or user interaction is required and the attack is network-borne, yet AC:H indicates the attacker must win a race, defeat a mitigation, or satisfy specific preconditions, which lowers real-world exploitability versus a typical AC:L RCE. No EPSS score was supplied, the CVE is not in CISA KEV, and no proof-of-concept was provided, so there is no evidence of active or automated exploitation at this time. Net assessment: a legitimate patch priority for internet- or untrusted-network-exposed Coherence deployments given unauthenticated network reach and total-compromise impact, but the high attack complexity and absence of a known exploit place it below drop-everything, wormable-class issues. Note the tension between Oracle's 'Information Disclosure' tag and the full C/I/A 'takeover' impact - treat this as compromise-grade and verify specifics against Oracle's advisory rather than the tag alone.

An attacker who can reach a Coherence cluster member or Extend proxy port sends a specially crafted TCP payload that the Core component processes without authentication, and after satisfying the timing or state preconditions implied by the high attack complexity, gains control of the Coherence process. From there they can read or tamper with cached data and disrupt the grid, achieving full takeover. No public proof-of-concept is available at time of analysis.