Oracle Coherence CVE-2026-60300

The affected Oracle Coherence node must expose a reachable TCP listener (Coherence*Extend proxy or cluster port) to the attacker, and must run one of versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are stated to be required - remote unauthenticated exploitation against any reachable Coherence listener. The dominant limiting factor is network reachability of the Coherence TCP port: deployments that confine cluster/Extend ports to isolated internal networks behind firewalls substantially reduce exposure, and Extend proxy authentication or TLS would further constrain an attacker.

All available severity signals point to top-tier priority: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields 9.8, meaning remote, unauthenticated, low-complexity exploitation with no user interaction and total compromise of confidentiality, integrity, and availability, reinforced by Oracle's own 'easily exploitable' and 'takeover' wording. However, no EPSS score was supplied, the CVE is NOT in CISA KEV, and no POC has been identified, so there is no current evidence of active or imminent exploitation - the risk is severe-but-not-yet-observed rather than confirmed in the wild. Note a conflict in the input: the tags label this 'Information Disclosure', which contradicts the vector's full C/I/A takeover impact; the CVSS vector and Oracle's 'takeover' description should be trusted over the tag. Given Coherence's network-facing ports and the low exploitation barrier, this warrants emergency patch prioritization despite the absence of a public exploit.

An attacker able to reach a Coherence Extend proxy or cluster TCP port sends a crafted request to the exposed listener without any credentials, triggering the Core-component flaw and gaining control over the Coherence node and its cached data. No user interaction or prior foothold is required (AV:N/AC:L/PR:N/UI:N), so an internet-exposed or lateral-network-reachable listener could be compromised directly. No public POC has been identified at time of analysis.