Oracle Coherence CVE-2026-60306

Exploitation requires network TCP reachability to an affected Oracle Coherence instance's Core/cluster or Extend-proxy listener on versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no authentication, privilege, or user-interaction prerequisites and default configurations are exploitable once the port is reachable. The primary limiting factor is network exposure: Coherence cluster/proxy ports are frequently confined to internal or management network segments, so an attacker must already be on a network path that can reach the listener - this is the main control that reduces real-world reach despite the maximal CVSS. No non-default feature toggle is named in the description as a precondition.

All available signals point to genuine high priority rather than an inflated CVSS number: the vector is AV:N/AC:L/PR:N/UI:N (remote, low complexity, no privileges, no user interaction) and the impact is C:H/I:H/A:H culminating in complete product takeover, which Oracle explicitly calls 'easily exploitable.' There is no EPSS score, no SSVC decision data, no POC, and no CISA KEV entry in the provided input, so probability-of-exploitation modeling and confirmed active-exploitation signals are all missing - the assessment rests on CVSS and Oracle's advisory language. The absence of KEV/EPSS does not lower the intrinsic risk of an unauthenticated network takeover; it only means widespread exploitation has not yet been observed or scored. One tag reads 'Information Disclosure,' which conflicts with the description's 'takeover' and full C/I/A impact - treat the takeover/full-compromise framing (backed by the CVSS vector) as authoritative and the tag as an under-description.

An attacker who can reach a Coherence cluster or Extend/proxy TCP port sends a crafted message to the exposed Core listener and, with no credentials and no user interaction, triggers the flaw to gain control of the Coherence process. Because impact is full C/I/A takeover, the attacker can read and manipulate cached/grid data and execute in the context of the Coherence server, potentially pivoting into the surrounding Fusion Middleware/WebLogic environment. No public POC is identified at this time, but the low complexity makes weaponization straightforward once details emerge.