Oracle Coherence CVE-2026-60286

No special conditions - remote unauthenticated exploitation over HTTP against network-reachable Oracle Coherence (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0), consistent with AV:N/AC:L/PR:N/UI:N. The primary practical prerequisite and limiting factor is network reachability of the Coherence HTTP endpoint: an attacker must be able to route an HTTP request to the affected Coherence port, so deployments where Coherence is confined to an isolated internal cluster network, firewalled, or not HTTP-exposed materially reduce real-world exploitability. Exploitation is bounded to the listed supported versions; the exact fixed build removes the condition entirely.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes the worst-case profile: network-reachable, low complexity, no privileges, no user interaction, and full triadic impact - a textbook priority-patch candidate, reinforced by Oracle's own 'easily exploitable' and 'takeover' phrasing. Countervailing signals temper urgency: no EPSS score was provided, the CVE is not in CISA KEV, and no public exploit or POC has been identified, so this reflects theoretical exploitability rather than observed in-the-wild activity. The 'Information Disclosure' tag conflicts with the C:H/I:H/A:H vector - the vector should be treated as authoritative and the tag as an incomplete label. Bottom line: this is a genuine high priority for any exposed Coherence deployment because of the network-unauthenticated-RCE profile and low attack complexity, but the absence of KEV/EPSS/POC data means exploitation is currently a modeled risk, not a confirmed campaign.

An attacker who can reach a Coherence node's HTTP-exposed port on the network sends a single crafted HTTP request that requires no credentials and no user interaction, triggering the flaw and gaining full control of the Coherence instance. Because attack complexity is low and the impact is total takeover, the compromised data-grid node can then be used to read or tamper with cached application data and pivot into the surrounding Fusion Middleware/WebLogic environment. No public exploit code has been identified at time of analysis, so this scenario is derived from the CVSS vector and Oracle's takeover description rather than an observed exploit.