Oracle Coherence CVE-2026-60305

Exploitation requires TCP network access to an Oracle Coherence listener (cluster or Coherence*Extend/proxy port) and, per the CVSS vector, PR:L - a low-privileged authenticated foothold - with no user interaction. Limiting factors: the target must run an affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0) and the attacker must be able to reach the Coherence TCP port, so deployments that isolate Coherence listeners behind internal-only network segments materially reduce exposure. Note the input tag 'Authentication Bypass' conflicts with the PR:L rating; if the bypass in fact permits unauthenticated access, the practical precondition drops to network reachability alone - confirm with the Oracle advisory.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, base 7.1) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high integrity impact but only limited confidentiality and no availability impact - a genuine tampering/integrity risk rather than a full compromise. Oracle explicitly labels it 'easily exploitable,' which aligns with AC:L. However, key priority signals are absent: no EPSS score was provided, there is no KEV listing (not confirmed actively exploited), and no POC was supplied (no public exploit identified at time of analysis), so this should be treated as a high-but-not-emergency patch priority. Note a tension worth verifying: the vector requires PR:L (an authenticated low-privileged attacker), yet the tag reads 'Authentication Bypass' - verify with the vendor whether the bypass grants unauthenticated access, which would raise real-world risk above the stated PR:L rating. No SSVC decision data was provided in the input.

An attacker who holds a low-privileged account or foothold able to reach a Coherence TCP listener sends crafted requests that abuse the authentication/authorization weakness to write to or delete entries in critical cached data sets, corrupting application state or falsifying business data. Because attack complexity is low and no user interaction is needed, this can be scripted once network reachability exists; no public exploit was identified at time of analysis.