Oracle Coherence CVE-2026-60307

The attacker must have network access to the Oracle Coherence HTTP interface and must possess at minimum low-level credentials (PR:L per CVSS vector) - unauthenticated exploitation is not supported by the available vector. The target must be running one of the four affected versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0. No user interaction is required (UI:N). Exploitation is limited to read access of a subset of Coherence data - no write, delete, or code execution capability is indicated. The scope does not change (S:U), meaning lateral movement to other systems via this vulnerability alone is not confirmed. Key limiting factor: the requirement for at least low-privilege credentials constrains exploitation to authenticated insiders, stolen credential scenarios, or accounts provisioned with minimal Coherence access rights.

The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) classifies this as medium severity: low attack complexity, no user interaction, and network reachable, but constrained by the requirement for low-privileged access and limited to partial confidentiality loss with no integrity or availability impact. The 'Authentication Bypass' tag introduces a nuance: if an attacker can leverage minimal credentials to read data segments reserved for administrators or other roles, the business-risk of cache data exposure (which may include session tokens, PII, or application secrets) may exceed what the raw CVSS score conveys. No KEV listing confirms active exploitation, no POC has been identified, and no EPSS score was provided - leaving exploitation likelihood as UNKNOWN from quantitative signals. Risk is highest for organizations where Oracle Coherence caches sensitive application data accessible over HTTP. The absence of integrity and availability impact makes this primarily a data-disclosure concern rather than a service-disruption or code-execution risk.

An attacker holding low-privilege credentials to an Oracle Coherence deployment sends crafted HTTP requests to the Core component's accessible endpoint, exploiting the authorization bypass to enumerate or read cached data entries scoped to higher-privileged roles or other tenants. No public proof-of-concept exploit code has been identified at time of analysis, so exploitation would currently require independent discovery of the specific bypass mechanism.