EUVD-2026-46645
GHSA-54f2-49jv-vh8q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Coherence TCP port
-
DeliverySend crafted request to Core listener
-
ExploitTrigger unauthenticated code path
-
ExecutionAchieve process takeover
-
ImpactExfiltrate or tamper cached data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over TCP against affected versions of Oracle Coherence, per Oracle's CVSS vector (AV:N/AC:L/PR:N/UI:N) and 'easily exploitable' characterization. The concrete prerequisite is network TCP reachability to a Coherence Core listener (cluster port or a Coherence*Extend proxy port). Limiting factors that reduce real-world exposure: the affected version must be one of 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0; and Coherence ports are frequently deployed on internal/back-end networks rather than internet-facing, so instances firewalled off from untrusted networks are not remotely reachable by external attackers. |
| Impact | All available signals point to genuine high priority rather than an inflated CVSS: the vector is AV:N/AC:L/PR:N/UI:N (network, low complexity, no privileges, no user interaction) with C:H/I:H/A:H and Oracle itself characterizes it as 'easily exploitable' resulting in 'takeover.' This is not a paper-tiger high score - exploitation requires no authentication and no special conditions against affected versions. Countervailing factors: there is no CISA KEV listing, no public POC identified, and no EPSS score provided in the input, so real-world exploitation activity cannot yet be confirmed. The tag 'Information Disclosure' understates the impact and conflicts with the full C/I/A takeover described by Oracle - defenders should weight Oracle's CVSS vector and 'takeover' language over the tag. Net: treat as urgent for any internet- or untrusted-network-reachable Coherence deployment. |
| Exploit ScenarioDerived | An attacker who can reach a Coherence cluster or proxy TCP port from the network sends a crafted request/object to the exposed Core listener, requiring no credentials and no user interaction. The low attack complexity and network vector mean the attacker gains full control of the Coherence process, leading to data theft, tampering, and service disruption. No public POC has been identified at time of analysis, so this scenario is derived from Oracle's CVSS vector and 'takeover' characterization rather than a demonstrated exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Remote unauthenticated compromise of Oracle Coherence (a component of Oracle Fusion Middleware) allows attackers with only network TCP access to fully take over the affected instance, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 9.8 and affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit identified at time of analysis, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) and full confidentiality, integrity, and availability impact make this a high-priority patch item.
RemediationAI
Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); Oracle publishes exact patch numbers per product version in the CPU matrix, and administrators should apply the CPU corresponding to their installed release (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0). Because Oracle CPUs are cumulative, the latest CPU supersedes prior fixes. If patching cannot be done immediately, the primary compensating control is network isolation: restrict TCP access to Coherence cluster and proxy/extend ports (commonly the cluster port and any configured Coherence*Extend proxy listener) to trusted management subnets via firewall/security-group rules, and ensure no Coherence port is exposed to the internet or untrusted VLANs - the trade-off is that legitimate remote Extend clients must be re-scoped or tunneled. Where deserialization is the suspected vector, enabling and tightening Coherence serialization filters/allowlists (POF or JEP-290-style object-input filtering) reduces exposure but can break clients relying on default Java serialization and does not substitute for the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Coherence is Oracle's in-memory data grid (IMDG) and distributed caching/clustering platform used to scale stateful Java applications, commonly deployed alongside Oracle WebLogic Server within Fusion Middleware. The vulnerable 'Core' component handles clustering and inter-node communication over TCP, which is the exposed attack surface here. Oracle does not assign a CWE (listed as N/A), but network-reachable takeover flaws in Coherence historically stem from unsafe deserialization of untrusted objects received over the cluster/proxy protocol - a class consistent with CWE-502 - though this root cause is inferred, not confirmed by Oracle.
Know when Oracle Coherence gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle describes easily exploitable, unauthenticated network TCP access yielding full takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H; scope unchanged as compromise stays within the Coherence process.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Coherence (Oracle Fusion Middleware) contains a critical remote unauthenticated vulnerability (CVE-2026-60230, CVSS 9.8) enabling complete system compromise across affected versions 12.2.1.4.0 through 15.1.1.0.0 with no patch currently available. Any network-accessible Coherence deployment is immediately at risk of full confidentiality, integrity, and availability breach without authentication or user interaction.
Until vendor patch is released: enforce strict network access controls limiting Coherence TCP connectivity to trusted internal networks; deploy security monitoring and intrusion detection focused on abnormal Coherence traffic; consider air-gapping or isolating critical Coherence instances if operationally feasible; establish enhanced incident response procedures given the severity and trivial exploitability of this vulnerability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Coherence
View allRemote takeover of Oracle Coherence (Fusion Middleware) via the Centralized Third Party Jars component allows an unauthe
Remote takeover of Oracle Coherence is possible via HTTP by an unauthenticated network attacker, affecting Oracle Fusion
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core compon
Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reach
Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion
Remote unauthenticated takeover of Oracle Coherence (Oracle Fusion Middleware) is possible over HTTPS, affecting support
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remo
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the netwo
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Co
Exploit-DB