EUVD-2026-46687
GHSA-w3fv-cv8v-hh87
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Coherence HTTP endpoint
-
DeliverySend crafted unauthenticated request
-
ExploitTrigger flaw in Core component
-
ExecutionGain control of Coherence process
-
ImpactFull takeover of data grid
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against Oracle Coherence (Core component) on supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, consistent with AV:N/AC:L/PR:N/UI:N. The practical limiting factor is network reachability: the target Coherence HTTP interface (management/REST/Extend proxy) must be accessible to the attacker, so instances confined to isolated internal management networks are materially harder to reach than internet- or broadly-exposed deployments. Exploitation also requires the affected version to be running, so environments already on patched CPU builds are out of scope. |
| Impact | All available signals point to a genuine high priority rather than an inflated CVSS score: the vector is AV:N/AC:L/PR:N/UI:N with full H/H/H impact, meaning remote, unauthenticated, low-complexity exploitation leading to takeover, and Oracle explicitly labels it 'easily exploitable.' Working against immediate panic, there is currently no EPSS score, no POC, and no KEV listing in the provided data, so exploitation is theoretically trivial but not yet observed or proven in the wild. One notable inconsistency: the tags label this 'Information Disclosure,' yet the description and the I:H/A:H metrics indicate full takeover with integrity and availability impact - the tag understates the severity and should not be relied upon. Overall this warrants prompt patching given the CVSS profile and Oracle CPU sourcing, even though real-world exploitation probability data is missing. |
| Exploit ScenarioDerived | An attacker who can reach a Coherence HTTP endpoint over the network sends a single crafted request that requires no authentication and no user interaction, exploiting the Core component to gain control of the Coherence process. Because low attack complexity and network vector apply, this can be executed remotely at scale against exposed instances, resulting in full takeover of the data grid and the sensitive cached application state it holds. No public POC is identified at this time, so the scenario reflects the CVSS-derived capability rather than an observed exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware (Core component), is possible by remote unauthenticated attackers over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 and Oracle describes it as easily exploitable, allowing complete takeover with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
RemediationAI
Apply the fixes delivered in Oracle's July 2026 Critical Patch Update as documented at https://www.oracle.com/security-alerts/cpujul2026.html; the input does not specify an exact patched build number, so treat the remediation as 'Patch available per vendor advisory' and pull the specific Coherence patch that corresponds to your installed version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0) from My Oracle Support. Until patched, reduce exposure by restricting network access to Coherence HTTP-facing interfaces (management/REST/Extend proxy ports) to trusted management subnets via firewall or network ACLs, and avoid exposing Coherence directly to the internet - the trade-off is that legitimate remote management and cross-datacenter cluster traffic must be re-scoped to the allowlisted paths. Where Coherence REST or management HTTP endpoints are not required, disable them to remove the attack surface, accepting the loss of those management/monitoring capabilities.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Coherence is an in-memory distributed data grid / caching platform used to scale stateful applications across clustered nodes, frequently embedded in Oracle WebLogic Server and broader Fusion Middleware deployments. The vulnerability resides in the Core component and is reachable over HTTP, which is consistent with Coherence's management, Extend/proxy, or REST interfaces that can be network-exposed. No CWE was assigned in the source data, so the precise root cause class (e.g., deserialization of untrusted data, a common pattern in Java middleware takeover bugs) cannot be confirmed from the provided intelligence; the single CPE 'cpe:2.3:a:oracle_corporation:oracle_coherence' confirms the affected product is the Coherence application itself across the listed versions.
Know when Oracle Coherence gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle confirms remote, unauthenticated, low-complexity HTTP exploitation yielding full product takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Coherence, a mission-critical in-memory data grid component embedded in Oracle Fusion Middleware deployments across the organization, faces a critical unpatched vulnerability enabling complete remote compromise by unauthenticated attackers. Without an available vendor patch, any exposed Coherence instance poses immediate risk of unauthorized data access, manipulation, or service disruption affecting both operational continuity and regulatory compliance. Immediate action is required to isolate affected systems and implement interim controls pending vendor patch release.
No vendor-released patch identified at time of analysis. Interim mitigations include: network access restrictions via firewall rules limiting Coherence connections to authorized internal systems only; disabling or severely restricting remote HTTP/HTTPS access where operationally feasible; implementation of enhanced logging and real-time monitoring to detect exploitation attempts; and network segmentation to isolate Coherence instances from untrusted networks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Coherence
View allRemote takeover of Oracle Coherence (Fusion Middleware) via the Centralized Third Party Jars component allows an unauthe
Remote takeover of Oracle Coherence is possible via HTTP by an unauthenticated network attacker, affecting Oracle Fusion
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core compon
Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reach
Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion
Remote unauthenticated takeover of Oracle Coherence (Oracle Fusion Middleware) is possible over HTTPS, affecting support
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remo
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the netwo
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Co
Exploit-DB