EUVD-2026-46656
GHSA-x4ww-v95c-7gcp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Coherence HTTP endpoint
-
DeliverySend crafted unauthenticated HTTP request
-
ExploitTrigger flaw in Core component
-
ExecutionExecute attacker-controlled logic
-
ImpactFull takeover of Coherence instance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network HTTP access to an affected Oracle Coherence instance (versions 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0, Core component); per the CVSS vector AV:N/AC:L/PR:N/UI:N there is no authentication, no user interaction, and low attack complexity required - remote unauthenticated exploitation is possible against reachable Coherence HTTP endpoints. The primary limiting factor is network exposure: the attacker must be able to reach a Coherence HTTP/management/proxy listener, so instances confined to isolated internal segments or firewalled from untrusted networks present a materially smaller attack surface. Exploitation is bounded to the three listed supported versions; the exact vulnerable feature or endpoint within Core was not specified in the source data. |
| Impact | All available signals point to high real-world risk: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes network attack vector, low complexity, no privileges, and no user interaction, and Oracle explicitly labels it 'easily exploitable' with full takeover impact. However, several corroborating signals are absent: no EPSS score was provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no public POC was identified, so exploitation is currently theoretical based on the vector rather than observed. The CWE is N/A and the exact attack precondition is not detailed, so while the CVSS-derived priority is CRITICAL, defenders should treat the specific exploitation mechanism as unverified pending Oracle advisory detail. Net assessment: this is a genuine high-priority issue driven by an unauthenticated RCE-class vector in enterprise middleware, not a high-CVSS-but-low-impact edge case, but the lack of EPSS/KEV/POC means the immediacy of mass exploitation is not yet demonstrated. |
| Exploit ScenarioDerived | An attacker who can reach a Coherence HTTP-facing endpoint over the network sends a crafted request that, with no authentication or user interaction, triggers the Core vulnerability and results in full takeover of the Coherence instance. Given AV:N/AC:L/PR:N/UI:N and Oracle's 'easily exploitable' rating, this could be automated against internet- or intranet-exposed Coherence servers, though no public POC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Remote code execution and full takeover in Oracle Coherence (Oracle Fusion Middleware, Core component) versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows an unauthenticated attacker with HTTP network access to completely compromise the product, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector and 'takeover' impact make it a top-priority patch candidate.
RemediationAI
Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (Patch available per vendor advisory) documented at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle CPUs ship cumulative patches per Coherence version line (14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0), so identify your exact release and apply the corresponding CPU patch - no standalone fixed build number was provided in the input, so confirm the precise patch level from the CPU matrix. Because exploitation is over HTTP by an unauthenticated attacker, until patching is complete restrict network reachability to Coherence management, Extend/proxy, and any HTTP-facing endpoints by placing them behind a firewall or internal-only segment and blocking untrusted access to the listening ports, accepting that this may disrupt legitimate remote clients or clustering across network boundaries. Where feasible, disable or bind Coherence Extend/REST and management HTTP listeners to trusted interfaces only and enforce authentication/TLS on cluster and proxy traffic, with the trade-off that these controls can break applications relying on open remote access.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Coherence is an in-memory data grid and distributed caching platform bundled with Oracle Fusion Middleware, used to scale application state and clustering across enterprise Java deployments. The vulnerability resides in the Core component and is reachable over HTTP, which is consistent with Coherence's management/extend/REST-facing services that accept remote requests. No CWE was assigned in the source data, so the precise root-cause class (e.g., deserialization, injection, or authentication bypass) cannot be confirmed from the provided intelligence; the 'takeover' language and full CIA impact are typical of unsafe deserialization or a remote code execution path in Java middleware, but this is inference, not vendor confirmation. The only CPE provided is cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:*, which does not pin exact version boundaries and must be cross-referenced with the version list in the description.
Know when Oracle Coherence gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle confirms unauthenticated HTTP-reachable, easily exploitable takeover with full CIA impact, supporting AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contain a critical unauthenticated remote code execution vulnerability enabling complete system takeover. No public exploit has been identified at time of analysis, but the absence of a vendor patch combined with the easily exploitable nature and CVSS 9.8 rating creates severe organizational risk. Immediate defensive action is required for all systems running these versions in Oracle Fusion Middleware environments.
Implement strict network segmentation isolating Coherence clusters to authorized internal networks only; deploy intrusion detection signatures and web application firewall rules on Coherence service ports; enable comprehensive audit logging with continuous real-time monitoring and alerting on service activity and configuration changes; restrict administrative interface access through multi-factor authentication and network whitelisting; disable or minimize internet-facing Coherence exposure; consider disabling Coherence on non-production systems to reduce attack surface pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Coherence
View allRemote takeover of Oracle Coherence (Fusion Middleware) via the Centralized Third Party Jars component allows an unauthe
Remote takeover of Oracle Coherence is possible via HTTP by an unauthenticated network attacker, affecting Oracle Fusion
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core compon
Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reach
Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion
Remote unauthenticated takeover of Oracle Coherence (Oracle Fusion Middleware) is possible over HTTPS, affecting support
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remo
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the netwo
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Co
Exploit-DB