Oracle Coherence CVE-2026-60282

Exploitation requires a low-privileged account with network access to the Oracle Coherence Core component over TCP - meaning the attacker must already hold some form of valid Coherence identity or credential (PR:L). No special non-default configuration is required beyond the Coherence service being network-accessible. Exploitation is NOT possible from an unauthenticated position based on the PR:L CVSS metric. The 'Authentication Bypass' tag suggests the bypass operates at the authorization layer (what a given authenticated user is permitted to do) rather than the authentication layer (proving identity). Factors limiting exploitation include: attacker must already possess a low-privileged Coherence credential or session; Coherence cluster ports must be reachable from the attacker's position; no availability impact limits destructive potential to data confidentiality and integrity only. Non-default network segmentation that blocks untrusted hosts from Coherence TCP ports further limits reachability.

The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) reflects a medium-severity issue: network-accessible with low attack complexity and no user interaction required, but constrained by the requirement for low-level authenticated access (PR:L) and limited to partial confidentiality and integrity impacts with no availability impact. The 'easily exploitable' descriptor in Oracle's advisory text is a specific Oracle CPU signal indicating the attack is low-friction once the preconditions are met, which meaningfully elevates practical risk above what the raw score suggests. The 'Authentication Bypass' tag introduces a tension with PR:L - a full authentication bypass would typically yield PR:N; the most likely interpretation is that an attacker with any low-privileged credential can bypass authorization controls to access data beyond their permitted scope. No EPSS data was provided. Neither CISA KEV listing nor public POC code is identified, so exploitation remains theoretical at time of analysis. For deployments where Coherence is exposed to internal networks with a broad low-privileged user population or where Coherence caches sensitive application data (session tokens, PII, financial records), real-world risk is elevated beyond the score alone.

An attacker with a low-privileged Coherence account - such as a developer, QA user, or compromised service account with minimal cluster access - connects to the Coherence Core component over TCP and issues cache operations (get, put, remove) against data partitions belonging to other tenants or roles. By bypassing authorization checks in the Core component, the attacker reads session tokens or configuration data they are not entitled to view, or injects tampered data into application caches to influence downstream application behavior. No public exploit code is available at time of analysis, but the 'easily exploitable' Oracle CPU designation suggests a low-skill bar once the attacker holds any valid credential.