Oracle Coherence CVE-2026-60309

Exploitation requires the attacker to have access to the physical/adjacent communication segment attached to the hardware where Oracle Coherence executes (CVSS AV:A) - for example, presence on the same VLAN, broadcast domain, or backend cluster network. No authentication is required (PR:N), no user interaction is needed (UI:N), and attack complexity is low (AC:L), so within that network position exploitation is straightforward against affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The key limiting factor is that this is NOT remotely exploitable across routed networks or the internet: an attacker cannot trigger it without first reaching the Coherence cluster segment, so network segmentation of the grid directly gates real-world exploitability.

The signals are moderately strong but not maximal. CVSS 3.1 is 8.8 with AV:A/AC:L/PR:N/UI:N and full C/I/A high, meaning low complexity and no authentication, but the Adjacent (not Network) vector is the single biggest limiting factor: an attacker must already be on the same broadcast/physical segment as the Coherence node, so an internet-facing 'wormable' scenario does not apply. No EPSS score, no KEV listing, and no POC were provided, so real-world exploitation is currently unproven - this is a high-severity, patch-on-schedule item rather than a confirmed emergency. Note a mild inconsistency between the source Tags ('Information Disclosure') and the description/CVSS, which indicate full compromise/takeover with high integrity and availability impact, not merely disclosure; the CVSS impact metrics should be trusted over the tag. In practice, prioritize this highly for Coherence clusters that share a network segment with untrusted or lightly-segmented hosts, and lower for well-isolated grid networks.

An attacker who has gained a foothold on a server or VLAN sharing the Coherence cluster's communication segment sends crafted cluster protocol traffic to a Coherence node, joining or manipulating the grid without any credentials. Because complexity is low and no user interaction is needed, this yields full compromise (read/modify cached data and control the node). No public exploit is identified at this time, so the scenario is inferred from the CVSS vector rather than an observed campaign.