Oracle Coherence CVE-2026-60283

No special configuration or non-default deployment mode is required beyond the Oracle Coherence HTTP-facing Core service being network-reachable. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires only network-level HTTP access with no credentials, no user interaction, and no elevated attack complexity - consistent with a default-configured Coherence deployment where HTTP services are enabled. Exploitation is constrained to the four named versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); impact is limited to read-only access to a subset of accessible data with no integrity or availability impact. Environments where Coherence HTTP ports are firewalled to internal networks only are significantly harder to target, as network reachability is the sole prerequisite.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N paints a picture of trivial network exploitation - no authentication, no complexity, no user interaction required - which elevates exploitation likelihood well above what the 5.3 Medium score alone suggests. However, the scope is unchanged (S:U) and confidentiality impact is Low (C:L), meaning only a partial data subset is exposed, not arbitrary cluster data or authentication credentials. No EPSS data was provided in the intelligence feed; no CISA KEV listing is present, and no POC is documented, all of which reduce urgency relative to CVSS attack-vector signals. The 'Authentication Bypass' tag warrants attention because bypassing authentication - even for partial reads - can expose session tokens, configuration data, or application state depending on what Coherence caches. Organizations with Oracle Coherence exposed to untrusted networks (internet-facing or multi-tenant environments) face the highest realistic risk. For internal-only, firewall-restricted deployments, the practical threat is substantially lower. No conflicting signals between CVSS vector and description - both consistently indicate network, unauthenticated, read-only partial impact.

An unauthenticated attacker with HTTP network access to an Oracle Coherence deployment sends a crafted HTTP request to the Core component that bypasses the expected authentication gate, receiving a response containing a subset of data from the Coherence cache or cluster. No public POC has been documented, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the attack is low-complexity once the exposed endpoint is identified through port scanning or service enumeration.