Oracle Coherence CVE-2026-60284

Exploitation requires network reachability to Oracle Coherence's HTTP-exposed Core interface on an affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0); per CVSS AV:N/AC:L/PR:N/UI:N no authentication, no user interaction, and no special configuration are needed against a reachable instance. The primary limiting factor is exposure: Coherence Core is commonly deployed on internal application/cluster networks, so attacks depend on the HTTP endpoint being reachable from the attacker's position - instances bound to internal interfaces or firewalled from untrusted networks are not remotely exploitable. Impact is bounded to confidentiality (full read of Coherence-accessible data) and limited integrity (some insert/update/delete), with no availability impact (A:N).

The signals broadly agree that this is a genuine priority for exposed instances: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes trivial, network-reachable, unauthenticated exploitation, and Oracle explicitly calls it 'easily exploitable,' which aligns with the Authentication Bypass tag. The 8.2 base score is driven by high confidentiality impact and low integrity impact, with no availability impact (A:N), so the practical risk is data theft plus some tampering rather than service disruption or full takeover. No EPSS score, no POC, and no KEV listing were provided, so probability-of-exploitation data is missing - the absence of a public exploit tempers immediacy but does not lower the ease of exploitation Oracle describes. One point to verify: Coherence Core is frequently deployed on internal cluster networks rather than internet-facing, so real-world exposure depends heavily on whether the HTTP-accessible endpoint is reachable by untrusted networks; the CVSS AV:N assumes network reachability that many hardened deployments restrict.

An attacker who can reach a Coherence Core HTTP endpoint sends crafted requests that bypass authentication and query or manipulate data held in the data grid, exfiltrating sensitive cached records and making limited unauthorized inserts, updates or deletes. Because no credentials, user interaction, or elevated privileges are required (PR:N/UI:N/AC:L), a single reachable instance is enough. No public proof-of-concept was identified at time of analysis, so exploitation would currently require the attacker to develop the technique independently.