Oracle Coherence CVE-2026-60278

No special conditions - remote unauthenticated exploitation against affected Oracle Coherence installations (12.2.1.4.0 and 14.1.1.0.0) is possible over HTTP, per CVSS AV:N/AC:L/PR:N/UI:N and Oracle's 'easily exploitable' rating. The one concrete prerequisite is network reachability to a Coherence HTTP-facing service (e.g., a management/REST or Coherence*Extend proxy endpoint); instances that bind these interfaces only to internal/loopback addresses or place them behind firewalls are not directly reachable and thus practically limited. Limiting factors: exploitation requires the vulnerable Core HTTP surface to be exposed and running one of the two affected versions - patched systems or those with the HTTP interface network-isolated are not exploitable.

All hard signals point to genuine high priority rather than an inflated CVSS number: the vector is AV:N/AC:L/PR:N/UI:N with S:U and C:H/I:H/A:H, meaning remote, low-complexity, unauthenticated exploitation with no user interaction and total impact on the target. Oracle explicitly describes it as 'easily exploitable,' reinforcing the low-complexity rating. Tempering factors are that no EPSS score was provided in the input, there is no public exploit identified at time of analysis, and it is not in CISA KEV, so widespread active exploitation is not currently evidenced. One inconsistency to flag: the tags include 'Information Disclosure,' yet the description and CVSS (I:H/A:H plus 'takeover') indicate far more than disclosure - treat the tag as incomplete metadata and rely on the CVSS/description, which describe full compromise. Net: unauthenticated network-facing full-takeover flaws in middleware are routinely reverse-engineered from patches within days to weeks, so patch urgency is high despite the current absence of a public POC.

An attacker who can reach a Coherence HTTP-facing port on the network sends a single crafted request to the exposed Core interface and, without any credentials or user interaction, gains control of the Coherence process - enabling data theft, tampering, and service disruption. Because Coherence often runs with application-level trust inside a WebLogic cluster, that foothold can be pivoted toward backend data and adjacent middleware. No public exploit code has been identified at time of analysis, but the low attack complexity makes weaponization straightforward once patch details are studied.