Oracle Coherence CVE-2026-60281

Exploitation requires the attacker to have access to the physical communication segment (Adjacent network, AV:A) attached to the hardware running Oracle Coherence - i.e., presence on the same broadcast/cluster network as Coherence members, not arbitrary internet reachability. No authentication is required (PR:N per the CVSS vector) and no user interaction (UI:N), and the attack is low-complexity (AC:L). Limiting factors that reduce real-world risk: the Adjacent-only vector means properly segmented deployments (Coherence cluster traffic isolated from general/untrusted networks) are largely out of reach for external attackers, and only the enumerated supported versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) are stated as affected.

Signals are moderately consistent but incomplete. CVSS 3.1 is 8.1 (High) driven by C:H/I:H with A:N, and the vector AV:A/AC:L/PR:N/UI:N describes a low-complexity, unauthenticated attack - but critically it requires Adjacent access, not full remote reachability, which meaningfully narrows the realistic attacker population to those already on the Coherence cluster network segment. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input. This reads as a genuine priority for organizations that expose Coherence cluster traffic on shared or under-segmented networks, but the Adjacent constraint makes it lower urgency than a true AV:N unauthenticated RCE. Note the description states 'Easily exploitable' (aligning with AC:L) yet gates it behind network-segment access - defenders should weigh their actual network segmentation posture rather than the raw 8.1 score.

An attacker who gains a foothold on the same network segment as a Coherence cluster (for example, a compromised host in the same VLAN or a malicious workload in a shared data-center subnet) joins or interacts with the cluster protocol without authenticating and reads or tampers with partitioned cache data. Because AC is low and no user interaction or privileges are required, exploitation is straightforward once segment access exists, though no public exploit code was identified at time of analysis.