Oracle Coherence CVE-2026-60296

The prerequisite is TCP network reachability to an affected Oracle Coherence instance (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0) Core component - per the CVSS vector AV:N/AC:L/PR:N/UI:N, exploitation requires no authentication, no special configuration, and no user interaction against affected versions. The primary limiting factor is exposure of the Coherence cluster/Extend proxy ports: these are commonly deployed on internal or management networks, so an attacker must already be able to route to the listening TCP port. No other non-default feature, platform, or configuration condition is stated in the available data.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes a near-worst-case remotely reachable flaw: no authentication, low attack complexity, no user interaction, and total loss of confidentiality, integrity and availability. That combination, plus Oracle's own "easily exploitable" wording, makes this a genuine high-priority issue rather than an inflated score. Countering that urgency, no EPSS score, SSVC decision, POC, or KEV entry was provided, so there is no evidence of active exploitation or public tooling yet - the risk is high potential impact with currently unproven exploitation. The main real-world limiter is exposure: Coherence cluster and Extend proxy ports are typically internal, so internet-facing exposure is likely lower than the network vector alone implies. Because CWE and technical root cause are absent, the exact exploitation mechanism should be verified against Oracle's advisory when available.

An attacker who can reach a Coherence cluster or Extend proxy TCP port sends a crafted request to the Core component and, without any credentials or user interaction, gains control of the data grid, reading or tampering with cached application data and disrupting the service. Because the CVSS complexity is low and no authentication is required, exploitation could be scripted against any reachable node. No public exploit code has been identified at time of analysis.