Oracle Coherence CVE-2026-60299

No special conditions beyond network reachability - remote unauthenticated exploitation over TCP against affected Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 (CVSS PR:N/UI:N/AC:L). The concrete prerequisite is TCP network access to a Coherence service port (cluster TCMP or a Coherence*Extend proxy). The main limiting factor is exposure: these ports are usually bound to internal/trusted networks, so an attacker must already be on a network segment that can reach the Coherence node; if the instance is not network-reachable from the attacker, exploitation is not possible. No specific non-default configuration is called out in the description as required.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes a maximally severe, unauthenticated, low-complexity network attack yielding full compromise, and Oracle explicitly labels it 'easily exploitable' - signals that all point to high real-world priority for exposed instances. However, no EPSS score, KEV listing, POC, or SSVC decision data was provided, so the probability and evidence of actual exploitation cannot be quantified from the input: this is currently a high-severity, high-potential issue rather than a confirmed actively-exploited one. The primary mitigating factor is exposure - Coherence cluster/Extend ports are typically deployed on internal or trusted network segments rather than the public internet, so realistic risk hinges heavily on network reachability. No signals conflict; the gap is simply the absence of exploitation-probability data.

An attacker with TCP reachability to a Coherence cluster or Coherence*Extend proxy port sends a crafted request that the server processes without authentication, achieving code execution or full control of the Coherence node. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or unusual timing are required, and Oracle rates it easily exploitable - though no public POC has been identified at time of analysis.