EUVD-2026-46661
GHSA-jcq8-3626-mf7m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Coherence TCP port
-
DeliverySend crafted Core protocol message
-
ExploitExploit unauthenticated flaw
-
ExecutionGain control of Coherence process
-
ImpactTake over cache data and node
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network TCP reachability to an Oracle Coherence Core listener (cluster or Coherence*Extend proxy port) on an affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) - no authentication (PR:N), no user interaction (UI:N), and low complexity (AC:L) per the CVSS vector. The primary limiting factor is network exposure: Coherence ports are frequently bound to internal cluster subnets, so an attacker must be on a network segment that can route to the listener; deployments that keep proxy/cluster ports off untrusted networks or enforce authorized-hosts/SSL listeners meaningfully reduce reach. There is no default-configuration caveat in the Oracle text, so against a network-reachable default Coherence instance no special feature toggle is needed. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields 9.8 and describes the worst practical profile: network-reachable, low complexity, no privileges, no user interaction, full CIA impact. Under an SSVC lens this maps to high technical impact and likely automatable exploitation once a technique is public. Counterbalancing signals: the vulnerability is not listed in CISA KEV, no POC or EPSS score was supplied, and no exploit is public yet - so there is no evidence of active or widespread exploitation. The realistic priority is nonetheless high because Coherence proxy/cluster ports are sometimes exposed beyond trusted network segments and an unauthenticated takeover primitive tends to be weaponized quickly after Oracle CPU disclosure. Note the conflict flagged above: Oracle's 'Information Disclosure' tag contradicts the C:H/I:H/A:H takeover language in the description - treat the full-takeover description as authoritative and the tag as mislabeled. |
| Exploit ScenarioDerived | An attacker who can reach a Coherence cluster or proxy TCP port from an adjacent or exposed network sends crafted protocol traffic to the Core component and, with no credentials or user interaction, gains full control of the Coherence process and its cached data. Because Oracle rates it 'easily exploitable' with low attack complexity, a single unauthenticated TCP session is sufficient to achieve takeover. No public exploit code has been identified yet, so this scenario is currently prospective rather than observed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Complete takeover of Oracle Coherence is possible by unauthenticated remote attackers over TCP against the Core component in Oracle Fusion Middleware versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates this 'easily exploitable' with full confidentiality, integrity, and availability compromise (CVSS 9.8), fixed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and the flaw is not on CISA KEV, so exploitation is currently theoretical but the barrier is minimal.
RemediationAI
Apply the Oracle July 2026 Critical Patch Update (patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html) for your Coherence release train; consult that CPU matrix for the exact patched bundle corresponding to 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0, as Oracle publishes fix identifiers per version rather than a single tag. Until patching completes, restrict network reachability of Coherence cluster and Coherence*Extend proxy TCP ports to trusted management segments via firewall/security-group rules and place proxies behind authenticated, TLS-enabled listeners - trade-off: tightening proxy access may break remote Extend clients and cross-datacenter clustering, so validate client connectivity after changes. Avoid exposing any Coherence port to untrusted or internet-facing networks, and enable Coherence security/authorized-hosts and SSL socket providers where supported to reduce the unauthenticated attack surface, accepting the added configuration and certificate-management overhead.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Coherence is an in-memory data grid and distributed caching platform bundled with Oracle Fusion Middleware, used for clustering and low-latency state sharing across application tiers. The affected 'Core' component handles the cluster/proxy protocol that Coherence nodes and Coherence*Extend clients use to communicate over TCP. The CPE (cpe:2.3:a:oracle_corporation:oracle_coherence) confirms the application-layer product across the listed release trains. No CWE was assigned in the input, but the combination of unauthenticated TCP access, 'easily exploitable', and full takeover is consistent with unsafe deserialization of untrusted cluster/proxy traffic - a recurring root-cause class in Java middleware - though the exact weakness class is not confirmed in the available data. Oracle's own tag labels this 'Information Disclosure', which understates the stated CIA=High/takeover impact and should be treated cautiously.
Know when Oracle Coherence gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated TCP-reachable takeover with no user interaction gives AV:N/AC:L/PR:N/UI:N, and stated full product compromise justifies C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Coherence in Oracle Fusion Middleware versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 is vulnerable to unauthenticated remote takeover (CVSS 9.8), threatening any organization that relies on Coherence for caching, data clustering, or distributed processing. A successful attack grants complete control over managed data and cluster operations, enabling theft of sensitive information, operational disruption, or data corruption. Immediate patching of all affected systems is critical to prevent potential breach or extended outage.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Coherence
View allRemote takeover of Oracle Coherence (Fusion Middleware) via the Centralized Third Party Jars component allows an unauthe
Remote takeover of Oracle Coherence is possible via HTTP by an unauthenticated network attacker, affecting Oracle Fusion
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core compon
Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reach
Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion
Remote unauthenticated takeover of Oracle Coherence (Oracle Fusion Middleware) is possible over HTTPS, affecting support
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remo
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the netwo
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Co
Exploit-DB