EUVD-2026-46690
GHSA-293q-5pc2-p657
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Coherence HTTP endpoint
-
DeliverySend crafted request to Core component
-
ExploitTrigger unauthenticated code execution
-
ExecutionTake over Coherence instance
-
ImpactAccess cached grid data and pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond network reachability - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote unauthenticated exploitation over HTTP against affected Oracle Coherence Core instances (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0). The practical limiting factor is exposure of the Coherence HTTP/extend endpoint: instances confined to isolated internal cluster networks and unreachable by an attacker are not exploitable, so network segmentation and firewalling are the primary factors that constrain realistic risk. No authentication, no user interaction, and no non-default feature toggle is required per the provided vector and description. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes the worst realistic profile: network-reachable, low complexity, no privileges, no user interaction, high impact to all three properties, and Oracle explicitly describes full 'takeover.' Oracle's own wording that the flaw is 'easily exploitable' reinforces the low-complexity rating. Countervailing signals moderate immediacy: no EPSS score was provided, there is no CISA KEV listing, and no public POC is referenced, so exploitation is not confirmed as active or widespread. The 'Information Disclosure' tag is narrower than both the 'takeover' description and the C:H/I:H/A:H impacts - treat the tag as an incomplete label and rely on the fuller takeover description. Net: this is a genuine high priority driven by an unauthenticated RCE-class profile in enterprise middleware, not an inflated score, even though real-world exploitation telemetry is absent from the input. |
| Exploit ScenarioDerived | An attacker with only network reachability to an exposed Oracle Coherence HTTP endpoint sends a crafted request to the vulnerable Core component without any credentials or user interaction, achieving code execution and full takeover of the Coherence instance. From there the attacker can read or tamper with cached grid data and pivot into the connected application tier. No public POC is referenced in the provided data, but the low complexity and unauthenticated vector make weaponization straightforward once technical details emerge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware allows an unauthenticated attacker to remotely compromise affected instances over HTTP, impacting confidentiality, integrity, and availability. Oracle rates this CVSS 9.8 and describes it as easily exploitable against supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and absence of any authentication requirement make it a top-tier patching priority.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Patch available per vendor advisory, though an exact fixed build number is not enumerated in the provided data, so map each affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) to its corresponding CPU patch or bundle in that advisory. Until patching completes, reduce exposure by restricting network reachability of Coherence HTTP and cluster ports to trusted management networks only and placing the tier behind a firewall or reverse proxy that blocks untrusted access, since the vulnerability requires only network access - note this can break legitimate client, extend, and cluster connectivity, so validate application traffic paths before applying. Where Coherence uses Java serialization over its extend/HTTP endpoints, enforce or tighten serialization allowlists/filters as a compensating control, accepting that overly strict filters may reject legitimate object types and require tuning.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Coherence is an in-memory data grid and distributed caching/clustering platform bundled with Oracle Fusion Middleware, widely used to scale WebLogic and other Java EE application tiers. The flaw resides in the Coherence Core component and is reachable over HTTP by an unauthenticated network client, consistent with the historical pattern of Coherence/WebLogic vulnerabilities rooted in unsafe deserialization of untrusted Java objects exposed over HTTP/extend/T3 endpoints leading to remote code execution. Oracle assigns no CWE (CWE: N/A), so the precise root-cause class is not confirmed in the provided data; the CPE cpe:2.3:a:oracle_corporation:oracle_coherence identifies the affected product but its wildcarded version field does not enumerate exact affected ranges.
Know when Oracle Coherence gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle describes easy unauthenticated HTTP exploitation resulting in full takeover, supporting AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
CVE-2026-60275 in Oracle Coherence (Oracle Fusion Middleware) allows unauthenticated remote attackers to achieve full system compromise with CVSS 9.8, affecting confidentiality, integrity, and availability across multiple versions. Organizations running Fusion Middleware versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 face critical risk to business-critical systems with no vendor patch currently available. The trivial attack surface and complete absence of authentication requirements necessitate immediate defensive action to protect operational continuity.
No vendor-released patch identified at time of analysis. Implement interim mitigations: (1) Network isolation - restrict Coherence HTTP access to known trusted IP ranges via firewall rules; (2) Authentication gateway - place affected instances behind reverse proxy or API gateway requiring multi-factor authentication; (3) Monitoring - enable detailed HTTP request logging with alerts on anomalous access patterns and failed authentication attempts; (4) Network segmentation - isolate affected systems into dedicated security zone with restricted egress; (5) Service disablement - disable Coherence in non-production environments if not actively required; (6) Vendor engagement - expedite patch notification through Oracle support channels.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Coherence
View allRemote takeover of Oracle Coherence (Fusion Middleware) via the Centralized Third Party Jars component allows an unauthe
Remote takeover of Oracle Coherence is possible via HTTP by an unauthenticated network attacker, affecting Oracle Fusion
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core compon
Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reach
Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion
Remote unauthenticated takeover of Oracle Coherence (Oracle Fusion Middleware) is possible over HTTPS, affecting support
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remo
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the netwo
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Co
Exploit-DB