CVE-2026-60237: Infoleak
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Coherence accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected supported versions are Oracle Coherence 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, specifically the Core component in Oracle Fusion Middleware.
Does an attacker need credentials or user interaction to exploit this issue?
No. The vulnerability is exploitable by an unauthenticated attacker with network access over TCP, and it does not require user interaction.
What access could an attacker gain?
Successful exploitation can allow unauthorized read access to a subset of data accessible through Oracle Coherence. The stated impact is limited to confidentiality; integrity and availability impacts are not identified.