Oracle Coherence CVE-2026-60304

Exploitation requires a low-privileged attacker with authenticated network access to Oracle Coherence over TCP - the CVSS PR:L metric confirms that some form of authentication or privilege is required, and unauthenticated exploitation is not indicated by available data. The Coherence Core component must be reachable over the network via TCP from the attacker's position. No user interaction is required. Exploitation is bounded to causing denial of service (hang or crash); confidentiality and integrity are not impacted. Deployments where Coherence TCP cluster ports are isolated behind firewall rules limiting access to trusted hosts significantly reduce practical exploitability. No specific non-default configuration is stated as a prerequisite beyond network reachability.

The CVSS 3.1 score of 6.5 Medium reflects a network-reachable, low-complexity denial-of-service flaw with availability-only impact. Key aggravating signals: Oracle's advisory explicitly labels this 'easily exploitable,' attack complexity is low, and no user interaction is needed, reducing the barrier for any authenticated attacker with TCP access. Key limiting signals: PR:L confirms at least some authentication or privilege is required (not unauthenticated), and the impact is strictly availability - no confidentiality or integrity exposure exists. EPSS data was not provided, and this CVE does not appear in CISA KEV, so no confirmed active exploitation is known. Without EPSS it is not possible to compare probabilistic exploitation likelihood against peer vulnerabilities. The real-world priority is highest for organizations running Oracle Coherence in environments where cluster TCP ports are accessible to untrusted or semi-trusted users (e.g., multi-tenant SaaS, shared development environments). Organizations with Coherence restricted behind strict network controls face substantially reduced practical risk.

An attacker holding a low-privileged account with TCP connectivity to an Oracle Coherence cluster sends a specially crafted request targeting the Core component, triggering a service hang or crash. Because attack complexity is low and no user interaction is required, the attacker can repeat the request to sustain a persistent denial-of-service condition. No public exploit code has been identified at time of analysis, but Oracle's 'easily exploitable' classification suggests minimal technical sophistication is needed beyond network access and valid credentials.