EUVD-2026-46674
GHSA-3jjj-9mc3-6r5r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Coherence HTTP endpoint over network
-
DeliverySend crafted request to Core component
-
ExploitExploit flaw without authentication
-
ExecutionAchieve full instance takeover
-
ImpactAccess/tamper cached data and pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network HTTP access to the Oracle Coherence Core component; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no special conditions - remote unauthenticated exploitation is possible against affected Coherence deployments (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) reachable over HTTP. The primary limiting factor is network reachability: Coherence cluster and Extend/management ports are typically deployed on internal application tiers rather than internet-facing, so organizations that segment these ports away from untrusted networks substantially reduce realistic exposure. No user interaction, authentication, or non-default configuration is indicated as required by the source data. |
| Impact | The signals align toward genuine high priority rather than an inflated CVSS. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H means network-reachable, low-complexity, no privileges, and no user interaction, with full CIA impact - Oracle explicitly labels it 'easily exploitable.' Countervailing the raw 9.8: it is not on CISA KEV and there is no public exploit identified at time of analysis, and no EPSS score was provided, so exploitation is not yet demonstrated or known to be widespread. Note a minor tension in the source data - the tag says 'Information Disclosure,' but the description and CVSS I:H/A:H indicate full takeover well beyond disclosure; the takeover characterization should be treated as authoritative. Oracle Fusion Middleware components are frequent, high-value targets, so exploit development following the CPU disclosure is plausible and defenders should not wait for KEV listing. |
| Exploit ScenarioDerived | An attacker who can reach a Coherence HTTP endpoint over the network sends a crafted request to the Core component and, without any credentials or user interaction, gains full control of the Coherence instance and the data it holds. Given Oracle's 'easily exploitable' rating and full CIA impact, this could be used to read or tamper with cached application data and pivot into the wider Fusion Middleware/WebLogic environment. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Full compromise of Oracle Coherence (Oracle Fusion Middleware Core component) is possible by a remote, unauthenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 9.8 and Oracle rates it 'easily exploitable,' with successful attacks resulting in complete takeover of the Coherence instance (full confidentiality, integrity, and availability loss). No public exploit has been identified at time of analysis, but the low attack complexity and lack of authentication make it a high-priority patch.
RemediationAI
Patch available per vendor advisory: apply the fixes in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0; Oracle does not publish a standalone semantic fix version separate from the CPU, so track the specific CPU patch number for your release rather than an invented version string. Until the CPU can be applied, reduce exposure by restricting network access to Coherence Extend/management and cluster HTTP ports so they are reachable only from trusted application tiers (via firewall/segmentation or a reverse proxy allowlist) - trade-off: may break legitimate remote clients or cross-tier caching if not scoped carefully. Where Coherence deserialization is involved, enabling any available serialization filtering/allowlisting and disabling unused HTTP-exposed management endpoints further limits reach, at the cost of possible feature loss for management tooling. Validate cluster functionality in staging before rolling mitigations to production.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Coherence is an in-memory data grid and distributed caching platform bundled with Oracle Fusion Middleware and WebLogic Server, used to scale stateful application data across clustered JVMs. The vulnerable 'Core' component is reachable over HTTP in this case; historically, Coherence takeover vulnerabilities have stemmed from unsafe Java deserialization of attacker-controlled data in cluster/extend and management endpoints. No CWE was supplied by the source (CWE: N/A), so the precise root-cause class cannot be confirmed, but a full-takeover, network-unauthenticated Fusion Middleware flaw of this profile is consistent with an insecure deserialization or remote-object-invocation weakness. CPE data confirms the affected product as cpe:2.3:a:oracle_corporation:oracle_coherence across all versions.
Know when Oracle Coherence gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle states unauthenticated network HTTP access with low complexity and full takeover, so AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H; scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Coherence (core Oracle Fusion Middleware component) is vulnerable to complete remote takeover by unauthenticated attackers over HTTP, with no vendor patch currently available. Organizations running Coherence in production face immediate risk of data breaches and operational shutdown if systems are exposed to untrusted networks.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Network segmentation-restrict Coherence access to trusted internal networks only via firewall rules, disable direct HTTP exposure; (2) Implement strict authentication and access controls on Coherence management interfaces; (3) Enable detailed logging of all access attempts and escalate suspicious activities for investigation; (4) Deploy endpoint detection and response (EDR) on Coherence hosts to detect anomalous process behavior and exploitation techniques; (5) Maintain offline backups isolated from production systems; (6) Prepare incident response procedures accounting for potential undetected compromise of affected systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Coherence
View allRemote takeover of Oracle Coherence (Fusion Middleware) via the Centralized Third Party Jars component allows an unauthe
Remote takeover of Oracle Coherence is possible via HTTP by an unauthenticated network attacker, affecting Oracle Fusion
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core compon
Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reach
Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion
Remote unauthenticated takeover of Oracle Coherence (Oracle Fusion Middleware) is possible over HTTPS, affecting support
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remo
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the netwo
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Co
Exploit-DB