Oracle Coherence CVE-2026-60288

The attacker needs only TCP network reachability to an affected Oracle Coherence Core listener (cluster TCMP transport or a Coherence*Extend proxy port) - no authentication, credentials, or user interaction are required per the vector PR:N/UI:N and Oracle's 'easily exploitable' rating. The practical limiting factor is network exposure: exploitation requires the Coherence port to be reachable by the attacker, so deployments where these ports are confined to isolated backend/cluster segments and firewalled from untrusted networks materially reduce realistic risk. Exploitation is constrained to the four listed supported versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0).

All available signals point to genuine high priority rather than an inflated CVSS score. The vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes remote, low-complexity, unauthenticated exploitation with no user interaction and full CIA impact, and Oracle's own 'easily exploitable' language reinforces low attack complexity. Countervailing that, no EPSS score is provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no public POC is identified, so exploitation today appears theoretical rather than observed. One data conflict must be flagged: the input Tags label this 'Information Disclosure', yet the description and CVSS both state full takeover with high integrity and availability impact - the description/CVSS should be trusted over the tag, which appears to be a loose categorization. Because the component sits on the network before authentication and impact is total, defenders should treat this as a top-tier patch even absent exploitation evidence.

An attacker who can reach a Coherence cluster or Extend proxy TCP port from the network sends a crafted message to the pre-authentication Core listener and triggers server-side code execution, achieving full takeover of the Coherence process and its host context. Because the vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or elaborate setup are needed. No public exploit identified at time of analysis, so this scenario is derived from the CVSS profile rather than an observed exploit.