EUVD-2026-46646
GHSA-6vf8-w2pq-j8rx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-accessible HTTP with low-privilege credential requirement; scope unchanged, no availability impact, partial confidentiality and integrity loss only.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Coherence accessible data as well as unauthorized read access to a subset of Oracle Coherence accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
AnalysisAI
Oracle Coherence (Core component) across all currently supported versions exposes authenticated low-privileged network attackers to unauthorized data access and manipulation over HTTP, enabling both partial read access and unauthorized insert, update, or delete operations on Coherence-accessible cached data. Disclosed as part of Oracle's July 2026 Critical Patch Update, this medium-severity flaw is tagged as an Authentication Bypass, suggesting that a low-privileged credential confers data access beyond its intended authorization scope rather than enforcing proper boundary controls. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis, but the low attack complexity (AC:L) and absence of required user interaction mean exploitation is straightforward for any attacker holding valid Coherence credentials.
Technical ContextAI
Oracle Coherence is Oracle's in-memory data grid and distributed caching platform, part of the Oracle Fusion Middleware stack, commonly deployed to provide high-performance shared session state, real-time caching, and event-driven data processing for enterprise Java applications. The affected component is Core - the fundamental data access, partitioning, and cluster communication layer - which exposes management and data interfaces over HTTP. The CPE (cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:*) confirms all versions in the named range are affected. No CWE was assigned (N/A in source data), but the 'Authentication Bypass' tag from ENISA EUVD (EUVD-2026-46646) points to an improper authorization enforcement flaw - likely within the Core HTTP interface - where a low-privileged principal can access or manipulate cache partitions, data stores, or management endpoints outside their authorized scope. The attack operates entirely over HTTP, consistent with Coherence's REST or cluster management interfaces rather than requiring a local or out-of-band vector.
RemediationAI
The primary remediation is to apply the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability across all four affected Oracle Coherence versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0). Exact patched version identifiers should be retrieved directly from the Oracle advisory, as specific fix version numbers were not independently confirmed in the available intelligence data. As compensating controls prior to patching: restrict network access to Oracle Coherence HTTP and REST management endpoints to trusted internal subnets or named IP ranges using host-based or network firewall rules - this reduces the pool of potential attackers to those already on trusted segments, though it does not eliminate risk for insider-threat scenarios. Additionally, audit and minimize the set of low-privileged accounts with network access to Coherence services, revoking any service or shared accounts that do not require direct Coherence HTTP access. These mitigations reduce exposure but do not remediate the underlying authorization flaw and should not substitute for patching.
More in Oracle Coherence
View allRemote takeover of Oracle Coherence (Fusion Middleware) via the Centralized Third Party Jars component allows an unauthe
Remote takeover of Oracle Coherence is possible via HTTP by an unauthenticated network attacker, affecting Oracle Fusion
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core compon
Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reach
Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion
Remote unauthenticated takeover of Oracle Coherence (Oracle Fusion Middleware) is possible over HTTPS, affecting support
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remo
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the netwo
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Co
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today