EUVD-2026-46677
GHSA-jqpm-rccg-j7vp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Coherence TCP listener
-
DeliverySend crafted request to Core service
-
ExploitTrigger unauthenticated flaw
-
ExecutionAchieve code execution / takeover
-
ImpactRead and tamper cached data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over TCP against affected Oracle Coherence versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0), consistent with AV:N/AC:L/PR:N/UI:N. The only real limiting factor is network reachability: the attacker must be able to reach a Coherence Core/cluster/Extend proxy TCP listener, so instances confined to a trusted, segmented back-end network are far less exposed than any node reachable from untrusted networks. No user interaction, no authentication and no non-default feature toggle are required per the vector and vendor description. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) indicates the strongest possible exploitability signals: remote, low-complexity, no privileges and no user interaction, with total impact to confidentiality, integrity and availability - Oracle's own 'easily exploitable, unauthenticated, results in takeover' language reinforces this. Counterbalancing the raw severity: there is no EPSS score, no SSVC decision data, no KEV listing and no public POC in the provided intelligence, so there is currently no evidence of active or automatable exploitation. This is a genuine priority because of the pre-auth network takeover profile and the enterprise footprint of the product, not merely a high-CVSS-but-low-risk case; however, the absence of EPSS/KEV/POC signals means exploitation is presently theoretical rather than observed. No conflicting signals were found - the CVSS vector and the description agree on network, unauthenticated access. |
| Exploit ScenarioDerived | An attacker with only TCP reachability to a Coherence Core/proxy listener sends crafted traffic to the service and, without any credentials or user interaction, gains full control of the Coherence instance and its cached data. Because the CVSS complexity is low and no authentication is required, exploitation could be scripted against any exposed node; no public POC has been identified at time of analysis, so this scenario is derived from the CVSS vector and Oracle's takeover description. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Remote takeover of Oracle Coherence (Fusion Middleware Core component) allows an unauthenticated network attacker to fully compromise the affected instance over TCP, per Oracle's July 2026 Critical Patch Update. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, all carrying a CVSS 3.1 base score of 9.8 with full confidentiality, integrity and availability impact. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the 'easily exploitable / unauthenticated / network' profile makes it a high-priority patch item.
RemediationAI
Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; Oracle publishes patched builds per affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) through the CPU rather than a single tagged release, so consult the CPU patch matrix for the exact bundle for your version and prioritize this as a critical, unauthenticated-takeover fix. Until patched, reduce exposure by restricting network access to Coherence cluster and Coherence*Extend/proxy listener ports so they are reachable only from trusted application-tier hosts (firewall/segmentation), which prevents untrusted TCP clients from reaching the vulnerable service but can break legitimate remote Extend clients that are not whitelisted. Where Coherence security is supported, enable cluster member authentication/TLS and disable unauthenticated Extend proxy endpoints; note these controls may require configuration changes and client-side updates and are compensating measures only - not a substitute for the CPU patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Coherence is an in-memory data grid and distributed caching platform bundled with Oracle Fusion Middleware, used to scale stateful Java applications through clustered caching, event processing and data partitioning across nodes. The flaw resides in the 'Core' component and is reachable over TCP, consistent with Coherence's cluster and proxy/extend communication services which listen on the network for member and client traffic. Oracle assigns no CWE (CWE: N/A) and does not publish root-cause detail; given a full-takeover impact in a Java middleware data grid reachable pre-authentication, the class most plausibly involves unsafe deserialization or protocol-level handling of untrusted network input, but this is inferred, not confirmed by the vendor.
Know when Oracle Coherence gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor states easily exploitable, unauthenticated network (TCP) access yielding full product takeover, so AV:N/AC:L/PR:N/UI:N with complete C/I/A impact and unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Coherence, a core enterprise data-caching component in Fusion Middleware deployments, is vulnerable to unauthenticated remote takeover with a 9.8 CVSS score affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No vendor patch is currently available, leaving affected instances at critical risk of complete system compromise. Organizations running Coherence must immediately identify and isolate affected systems while implementing emergency network containment measures.
Implement restrictive firewall rules limiting Coherence access to only authorized internal systems and services; deploy network segmentation isolating Coherence infrastructure from external and untrusted networks; configure network intrusion detection with Coherence-specific exploitation signatures; implement enhanced logging and real-time alerting for all Coherence network connections; enforce strict least-privilege access controls on all systems communicating with Coherence instances; conduct daily log and event review for indicators of compromise; perform regular security assessments targeting Coherence infrastructure until vendor patch is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Coherence
View allRemote takeover of Oracle Coherence (Fusion Middleware) via the Centralized Third Party Jars component allows an unauthe
Remote takeover of Oracle Coherence is possible via HTTP by an unauthenticated network attacker, affecting Oracle Fusion
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core compon
Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reach
Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion
Remote unauthenticated takeover of Oracle Coherence (Oracle Fusion Middleware) is possible over HTTPS, affecting support
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remo
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the netwo
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Co
Exploit-DB