Oracle Coherence CVE-2026-60279

No special conditions - remote unauthenticated exploitation against supported configurations of Oracle Coherence, requiring only HTTP network reachability to a Coherence node's Core component (CVSS AV:N/AC:L/PR:N/UI:N). The exploitation is limited by network exposure: the attacker must be able to reach the Coherence HTTP/cluster interface, so instances confined to trusted internal segments or firewalled off are correspondingly harder to reach. Affected scope is bounded to Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0; no specific non-default feature toggle is named as a precondition in the vendor description.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical) signals the worst realistic profile: network-reachable, low complexity, no privileges, no user interaction, and total impact to confidentiality, integrity, and availability. Oracle's own language ('easily exploitable', 'unauthenticated attacker', 'takeover') reinforces the vector rather than conflicting with it. No EPSS score, SSVC decision, POC, or KEV entry was supplied, so exploitation probability cannot be quantified from the data - this is currently a severity-driven priority rather than a confirmed in-the-wild threat. Note a minor inconsistency: the vendor tag labels this 'Information Disclosure' while the CVSS and description indicate full takeover; treat the CVSS/description as authoritative and the tag as understated. Given unauthenticated network exploitability of an enterprise middleware component, defenders should treat this as high priority regardless of the missing EPSS/KEV signals.

An attacker who can reach a Coherence node's HTTP-facing interface sends a crafted request to the Core component and, without any credentials or user interaction, gains full control over the Coherence instance. Because the vulnerability is easily exploitable and unauthenticated, an internet-exposed or lateral-network-reachable Coherence deployment could be taken over in a single automated request. No public proof-of-concept has been identified at time of analysis, but the low attack complexity makes reliable exploitation likely once details or tooling emerge.