Oracle Coherence CVE-2026-60274

No special conditions beyond network reachability - remote unauthenticated exploitation over TCP against Oracle Coherence (Core component) in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, per AV:N/AC:L/PR:N/UI:N. The concrete prerequisite is that the attacker can open a TCP connection to a Coherence service endpoint (cluster/TCMP transport or a Coherence*Extend proxy). The practical limiting factor is exposure: Coherence is typically deployed on internal application tiers, so exploitation depends on the attacker having a network path to the listening port; deployments that isolate Coherence ports behind segmentation or firewalls materially reduce reachability, while any environment exposing these ports to broad or untrusted networks is directly exploitable at default (unauthenticated) transport settings.

The signals available point to a genuine high priority. The CVSS 3.1 vector is maximal for exploitability - AV:N (network), AC:L (low complexity), PR:N (no privileges), UI:N (no interaction) - and maximal for impact (C:H/I:H/A:H), yielding 9.8, and Oracle independently characterizes it as 'easily exploitable' with a result of full product takeover. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified here, and no SSVC decision data (automatable, technical impact) was supplied. The vulnerability is not in CISA KEV and no POC was referenced, so there is no evidence of active exploitation - the risk is currently driven by ease of exploitation and severity, not confirmed in-the-wild activity. The description ('network access via TCP', unauthenticated) is internally consistent with the CVSS vector, so there is no conflict to flag; the main missing data are EPSS, CWE and any independent confirmation of the vulnerable code path.

An attacker with TCP reachability to a Coherence cluster or Extend proxy port sends a crafted request to the exposed Core service without any credentials or user interaction. Because the flaw permits full takeover, the attacker gains control over the Coherence process, allowing them to read and manipulate cached data and disrupt the service. No public POC has been identified at time of analysis, but the low attack complexity means reliable exploitation is expected once the technique becomes known.