EUVD-2026-46659
GHSA-gqgw-5xhf-cgc2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate exposed Coherence HTTP port
-
DeliverySend crafted request to Core interface
-
ExploitTrigger unauthenticated flaw
-
ExecutionExecute attacker payload
-
ImpactTake over Coherence instance and grid data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability to an Oracle Coherence Core HTTP endpoint on affected versions 12.2.1.4.0 or 14.1.1.0.0 - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and low attack complexity, so any default-reachable Coherence HTTP listener is a valid target. The primary limiting factor is network exposure: instances confined to isolated internal cluster segments, firewalled from untrusted networks, or not exposing the HTTP-facing interface are not remotely reachable and thus not exploitable by an outside attacker. Version is the other hard gate - only the two named supported releases are stated as affected. |
| Impact | All available signals point to high real-world priority: the CVSS 3.1 vector is the maximal remote profile (AV:N, AC:L, PR:N, UI:N) yielding 9.8 with full C/I/A impact, and Oracle explicitly labels it 'easily exploitable' with no authentication or user interaction. Countervailing signals temper urgency somewhat: it is NOT in CISA KEV, no POC or exploit code is identified at time of analysis, and no EPSS score was provided, so exploitation is currently assessed as feasible-but-not-yet-observed rather than confirmed active. Note a data conflict worth verifying: the feed tags this as 'Information Disclosure', but the CVSS I:H/A:H metrics and Oracle's 'takeover' language imply far more than disclosure - treat the tag as unreliable and the CVSS/description as authoritative. No SSVC decision record was provided; absent EPSS and KEV, the automatable/technical-impact judgments here are inferred from the CVSS vector only. |
| Exploit ScenarioDerived | An attacker who can reach a Coherence HTTP listener sends a single crafted request to the exposed Core interface and, without any credentials or user interaction, achieves full compromise of the Coherence instance and the data grid it fronts. Because AC:L/PR:N/UI:N means no special timing, auth, or victim action is needed, the attack is repeatable and scriptable; no public POC is identified at time of analysis, but the low complexity means one could emerge quickly after patch release. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Full remote takeover of Oracle Coherence (part of Oracle Fusion Middleware, Core component) in versions 12.2.1.4.0 and 14.1.1.0.0 is achievable by an unauthenticated attacker with only HTTP network access, per the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N with High Confidentiality, Integrity, and Availability impact (base score 9.8). Oracle rates it 'easily exploitable' and describes the outcome as complete compromise of Coherence. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial-access profile makes it a high-priority patch in the Oracle July 2026 Critical Patch Update.
RemediationAI
Apply the fixes from the Oracle Critical Patch Update - July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); this is patch-available per vendor advisory, though Oracle CPUs ship as quarterly patch bundles rather than a single named point release, so identify the exact Coherence patch for your 12.2.1.4.0 or 14.1.1.0.0 baseline from the advisory's patch matrix (no exact fix version is independently confirmed here). Until patched, reduce exposure by restricting network reachability of Coherence cluster and management HTTP ports to trusted management segments only (breaks any remote/inter-tier access that legitimately crosses those boundaries), placing Coherence behind a reverse proxy or firewall that denies untrusted HTTP, and - where Coherence uses Java serialization over the wire - enforcing serialization allowlists/filters (JEP 290 jdk.serialFilter) which can reject unexpected classes but may disrupt legitimate cluster traffic if misconfigured. Prioritize patching over these compensating controls given the unauthenticated, network-reachable nature of the flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Coherence is an in-memory data grid and distributed caching/clustering platform bundled with Oracle Fusion Middleware, frequently used to scale WebLogic and other Java EE application tiers. The affected code lives in the 'Core' component and is reachable over HTTP, which is consistent with the historical class of Coherence/WebLogic flaws driven by unsafe deserialization of untrusted data in the T3/IIOP/HTTP-fronted cluster and management interfaces. Oracle did not assign a CWE (CWE: N/A) and did not publish low-level technical detail, so the precise root cause is not confirmed; however, an unauthenticated 'takeover' over HTTP in a Java middleware grid product strongly points to remote-code-execution-grade deserialization or object-injection rather than a mere information-disclosure bug, despite the 'Information Disclosure' tag in the intelligence feed.
Know when Oracle Coherence gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle confirms unauthenticated HTTP-reachable, low-complexity exploitation yielding full takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H and unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Coherence versions 12.2.1.4.0 and 14.1.1.0.0 contain a critical remote code execution vulnerability (CVSS 9.8) enabling complete platform takeover via unauthenticated HTTP requests requiring no user interaction. Any organization running these versions faces immediate risk of full system compromise, data theft, and operational disruption. Urgent mitigation is required pending patch availability from Oracle.
Restrict network-layer access to Coherence systems via firewall segmentation and access control lists; enable full HTTP request logging and deploy intrusion detection rules for anomalous Coherence traffic; consider temporary relocation of non-critical Coherence workloads to air-gapped infrastructure. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Coherence
View allRemote takeover of Oracle Coherence (Fusion Middleware) via the Centralized Third Party Jars component allows an unauthe
Remote takeover of Oracle Coherence is possible via HTTP by an unauthenticated network attacker, affecting Oracle Fusion
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core compon
Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reach
Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion
Remote unauthenticated takeover of Oracle Coherence (Oracle Fusion Middleware) is possible over HTTPS, affecting support
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remo
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the netwo
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Co
Exploit-DB