Oracle Coherence CVE-2026-60303

Exploitation requires a valid low-privilege credential with HTTP network access to the Oracle Coherence Core component - the CVSS PR:L metric confirms authentication is mandatory; unauthenticated exploitation is not possible. The attacker must be able to route HTTP traffic to the Coherence endpoint (AV:N), meaning network segmentation or firewall rules blocking external access to Coherence ports substantially reduce exposure. No special non-default feature enablement or configuration is indicated as a prerequisite beyond standard Coherence deployment. What limits exploitation: the low-privilege credential requirement excludes fully unauthenticated external attackers; the partial-DOS-only impact (A:L, S:U) precludes privilege escalation or data exfiltration paths; and environments where Coherence HTTP is accessible only from trusted internal application subnets face materially reduced risk.

The CVSS 3.1 score of 4.3 (Medium) accurately reflects a moderately constrained risk profile. The attack vector is network-accessible over HTTP with low complexity (AV:N/AC:L), but PR:L requires the attacker to hold a valid low-privilege credential, which meaningfully restricts exploitation compared to unauthenticated flaws. The impact ceiling is partial availability loss (A:L/S:U) with no confidentiality or integrity exposure, limiting blast radius. No EPSS data was available in the intelligence sources, so exploitation probability cannot be independently quantified. The vulnerability does not appear in CISA's KEV catalog, and no public proof-of-concept has been identified - both signals consistent with vendor-coordinated disclosure without observed active exploitation. Oracle disclosed this through its standard July 2026 Critical Patch Update cycle, further supporting a controlled disclosure posture. In production environments where Coherence underpins application caching or session state, even partial availability degradation could cascade into application-layer outages, warranting timely patching. However, the authentication requirement and bounded impact make this a scheduled-maintenance priority rather than an emergency response for most deployments.

An attacker with a valid low-privilege account - such as a service account or application user granted access to the Coherence HTTP endpoint - sends a specially crafted HTTP request to the Core component of an affected Coherence instance. The malformed request triggers a condition that degrades cluster availability, resulting in partial denial of service affecting applications dependent on Coherence for caching or data grid services. No public proof-of-concept is available at time of analysis, but the low attack complexity (AC:L) suggests the trigger is reproducible once the flaw pattern is identified.