EUVD-2026-46685
GHSA-7cfg-qr63-mffc
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Network vector and high privilege confirmed by description; C:H reflects full grid data exposure, I:L for partial modification scope, A:N as no availability impact is described.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Coherence accessible data as well as unauthorized update, insert or delete access to some of Oracle Coherence accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N).
AnalysisAI
Oracle Coherence's Core component across all currently-supported Fusion Middleware releases is exploitable by high-privileged network attackers over HTTP to exfiltrate critical in-memory grid data and perform limited unauthorized data modification. Intelligence sources tag this as an authentication bypass class issue, suggesting that a legitimate high-privileged account can circumvent Coherence's internal data-scope access controls to reach data partitions or records beyond its authorized boundary. No public exploit code exists and the vulnerability does not appear in the CISA KEV catalog at time of analysis, placing this in the planned-maintenance remediation tier rather than emergency response.
Technical ContextAI
Oracle Coherence is an enterprise distributed in-memory data grid commonly deployed as a component of Oracle Fusion Middleware and embedded within Oracle WebLogic Server environments, where it provides high-availability caching, data partitioning, and cluster communication for Java EE applications. The affected component is labeled 'Core,' which encompasses the foundational data grid engine handling key-value storage, partition management, and cluster-member authentication. The CPE (cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:*) confirms all product editions under the oracle_corporation namespace are in scope. Oracle did not assign a CWE identifier in this advisory, leaving root cause classification dependent on secondary intelligence; however, the ENISA EUVD-2026-46685 record tags the vulnerability as 'Authentication Bypass,' most consistent with an authorization-enforcement deficiency (CWE-863: Incorrect Authorization or CWE-287: Improper Authentication) within the Core component's HTTP-facing interface, where privilege-boundary checks fail to confine a high-privileged session to its authorized data scope.
RemediationAI
Apply Oracle's Critical Patch Update (CPU) for July 2026, which is the authoritative fix for this vulnerability across all four affected releases. The CPU is documented at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle does not publicly disclose specific patched version strings outside the CPU patch delivery mechanism, so consult Oracle Support or My Oracle Support (MOS) for the precise patch identifiers applicable to your installed version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0). As a compensating control pending patch deployment, restrict HTTP access to Oracle Coherence management, cluster, and Core interfaces to only trusted administrator source addresses using host-based or network-layer firewall rules - this does not eliminate the vulnerability but reduces exposure by shrinking the network-reachable attack surface for the PR:H attack path. Additionally, audit and reduce the population of high-privileged Coherence accounts to enforce least privilege; removing unnecessary administrative grants limits which compromised or malicious accounts could trigger the bypass. Note that firewall restrictions may affect legitimate Coherence cluster federation or management tooling if those paths traverse the same HTTP interface - validate before enforcing in production. No specific patched version number has been independently confirmed outside of the Oracle CPU advisory.
More in Oracle Coherence
View allRemote takeover of Oracle Coherence (Fusion Middleware) via the Centralized Third Party Jars component allows an unauthe
Remote takeover of Oracle Coherence is possible via HTTP by an unauthenticated network attacker, affecting Oracle Fusion
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core compon
Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reach
Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion
Remote unauthenticated takeover of Oracle Coherence (Oracle Fusion Middleware) is possible over HTTPS, affecting support
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remo
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the netwo
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Co
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today