Oracle Coherence CVE-2026-60302

Exploitation requires TCP network reachability to an Oracle Coherence Core listener - a cluster member port or a Coherence*Extend proxy endpoint - on affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are needed against a reachable node: no special conditions beyond network access - remote unauthenticated exploitation against reachable configurations of Oracle Coherence. The primary limiting factor is network exposure: Coherence cluster and proxy ports are frequently confined to internal application tiers, so deployments with proper segmentation and no internet-facing proxy substantially reduce realistic exploitability, while flat networks or exposed proxies face the full risk.

All available severity signals point the same direction: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields 9.8 Critical - remote, network-reachable, low-complexity exploitation with no privileges or user interaction and total CIA impact. Oracle's own wording ('easily exploitable', 'takeover') reinforces the low-complexity assessment. Counterbalancing signals are absent rather than reassuring: no EPSS score was provided, so exploitation probability cannot be quantified; the CVE is not in CISA KEV, so there is no confirmed active exploitation; and no POC was supplied, so no public exploit is identified at time of analysis. The 'Information Disclosure' tag understates the actual impact, which the vector marks as full integrity and availability compromise as well - treat the tag as incomplete and defer to the CVSS vector. Because Coherence proxy/cluster ports are usually exposed only within application tiers, real-world exposure hinges on network segmentation; internet-exposed or flat-network deployments face the full 9.8 risk.

An attacker who can reach a Coherence cluster or Coherence*Extend proxy port - for example from a compromised host on the same data-center network or an internet-exposed proxy - sends a single crafted TCP message to the Core listener and, because no authentication or user interaction is required, gains code execution or full takeover of the Coherence node. From there they read and manipulate all cached application data and pivot into the surrounding Fusion Middleware/WebLogic environment. No public POC is identified at time of analysis, but the low attack complexity means weaponization would be straightforward once details circulate.