Oracle Coherence CVE-2026-60298

No special conditions beyond network reachability - remote unauthenticated exploitation over TCP against Oracle Coherence Core (AV:N/AC:L/PR:N/UI:N), affecting versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The practical limiting factor is network exposure: the attacker must be able to reach a Coherence cluster or Extend/proxy TCP listener port, which in well-segmented deployments is confined to internal management networks rather than the internet. No user interaction, authentication, or non-default feature toggle is required per the CVSS vector and Oracle's 'easily exploitable' rating, so the main defensive lever is restricting who can open a TCP connection to the Coherence ports.

The signals align toward genuine high priority rather than a paper-tiger high score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates remote, low-complexity, unauthenticated exploitation with full CIA impact, and Oracle's own 'easily exploitable' and 'takeover' language reinforces low real-world barriers. No EPSS score, KEV entry, POC, or SSVC decision data was supplied, so probabilistic and confirmed-exploitation signals cannot corroborate the severity - the assessment rests on Oracle's CVSS and prose alone. There is no conflict in the available data (network vector and TCP access are consistent), but the absence of a CWE and any technical root-cause detail limits deep validation. Treat as a top-tier patch target given the unauthenticated RCE-equivalent profile, while noting that active exploitation is not confirmed and exposure depends heavily on whether Coherence cluster/extend ports are reachable by the attacker.

An attacker with network reachability to a Coherence cluster or Extend proxy port sends a crafted TCP request to the Core listener and, without any credentials or user interaction, leverages the flaw to gain full control of the Coherence process and its data. Because the CVSS complexity is low and no authentication is needed, a single successful connection can yield takeover of the node and the sensitive in-memory data it holds. No public proof-of-concept was identified at time of analysis, so exploitation would currently require independent development.