Oracle Coherence CVE-2026-60289

The required precondition is network reachability to an Oracle Coherence HTTP endpoint of the vulnerable 'Core' component on an affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0); the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and low attack complexity, so exploitation works against default configurations once the HTTP surface is reachable. The primary limiting factor is network exposure: Coherence commonly runs inside internal middleware tiers, so instances whose HTTP/management ports are firewalled off from untrusted networks are not remotely exploitable by external attackers even though the flaw itself requires no special product configuration.

All available signals point to genuine high priority rather than an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicates remote, low-complexity, unauthenticated exploitation with no user interaction and full CIA impact, and Oracle explicitly labels it 'easily exploitable' - a vendor-confirmed low-effort profile. Countervailing signals temper urgency: no EPSS score is provided, no proof-of-concept is referenced, and the CVE is not in CISA KEV, so there is no public exploit identified at time of analysis and no confirmed active exploitation. Note a minor inconsistency in the source data: the Tags list 'Information Disclosure,' yet the description and vector describe full takeover with high integrity and availability impact - the 'takeover' characterization should be treated as authoritative and the tag as under-scoped. Given that Coherence typically sits inside enterprise middleware tiers, exposure depends on whether HTTP endpoints are network-reachable to the attacker, but the pre-authentication, full-compromise nature warrants prompt patching.

An attacker with network reachability to a Coherence HTTP endpoint sends a single crafted request to the exposed 'Core' interface without any credentials or user interaction, leveraging the low-complexity flaw to achieve full compromise of the Coherence process. Because the outcome is 'takeover,' the attacker can then read and manipulate cached/grid data, disrupt the service, and pivot within the middleware tier. No public proof-of-concept is referenced at time of analysis.