EUVD-2026-46691
GHSA-gh3r-pg2q-qmh2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Coherence HTTPS interface
-
DeliverySend crafted request to Core
-
ExploitExploit unauthenticated flaw
-
ExecutionAchieve full Coherence takeover
-
ImpactAccess cached data and disrupt grid
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The required condition is network reachability of the Oracle Coherence Core component over HTTPS; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no authentication or user-interaction prerequisites - unauthenticated remote exploitation against affected supported versions. What limits exploitation is exposure of the Coherence HTTPS/cluster interface: instances confined to isolated internal networks or fronted by strict segmentation are not reachable by external attackers, and only versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are named as affected. No non-default feature toggle is cited by Oracle as being required. |
| Impact | This is a genuine high priority, not merely a high-CVSS artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicates network-reachable, low-complexity, unauthenticated exploitation with full triad impact - the most severe combination short of scope change. Oracle explicitly labels it 'easily exploitable' allowing 'takeover,' reinforcing the vector. No EPSS score, KEV listing, SSVC decision, or POC was supplied in the input, so exploitation probability and automatability cannot be quantified from the data provided; the absence of KEV means there is no evidence of active exploitation yet, and the absence of a POC means no public exploit is confirmed. The primary limiting factor is network exposure of the Coherence interface - grids deployed on isolated internal cluster networks are less exposed than internet- or DMZ-facing instances. Given Oracle Fusion Middleware's enterprise footprint, treat this as urgent despite the missing EPSS/KEV signals. |
| Exploit ScenarioDerived | An attacker who can reach a Coherence node's HTTPS interface from the network sends a crafted request to the Core component without any credentials, and low attack complexity means the exploit succeeds reliably against affected versions. This yields full takeover of the Coherence instance - reading cached data, tampering with grid state, and disrupting availability. No public exploit is identified at time of analysis, but the unauthenticated, low-complexity profile makes reliable exploitation straightforward once a technique is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Complete takeover of Oracle Coherence is possible when an unauthenticated remote attacker reaches the Core component over HTTPS, per Oracle's July 2026 Critical Patch Update. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and the CVSS 3.1 base score of 9.8 reflects full confidentiality, integrity, and availability compromise with no privileges or user interaction. No public exploit identified at time of analysis, but the low attack complexity and 'easily exploitable' framing from Oracle make this a high-priority patch.
RemediationAI
Patch available per vendor advisory: apply the Oracle July 2026 Critical Patch Update fixes for Oracle Coherence corresponding to your installed version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0), following https://www.oracle.com/security-alerts/cpujul2026.html; Oracle publishes the exact patch numbers per release in that advisory rather than a single fix version. Because Oracle strongly recommends applying CPU patches without delay, prioritize this for any Coherence instance reachable over the network. Until patching is complete, reduce exposure by restricting network access to Coherence cluster and management ports so only trusted application hosts can reach them (firewall/segmentation), placing Coherence on an isolated back-end network segment, and terminating or restricting the HTTPS interface used for the affected Core communication - noting the trade-off that overly tight segmentation can disrupt legitimate cluster member communication and management tooling, so validate member connectivity after any network changes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Coherence is an in-memory data grid and distributed caching/clustering platform bundled with Oracle Fusion Middleware, frequently embedded behind WebLogic Server to provide scalable session and application state management. The flaw resides in the Core component and is reachable via HTTPS network access, indicating exposure through a management or cluster communication interface. Oracle assigned no CWE (CWE: N/A) and the 'takeover' impact combined with the Information Disclosure tag is consistent with the deserialization/injection class of weaknesses historically seen in Coherence and WebLogic; however, the exact root cause is not disclosed in the available data and cannot be confirmed. The single affected CPE is cpe:2.3:a:oracle_corporation:oracle_coherence, with version detail carried in Oracle's advisory rather than the CPE wildcard.
Know when Oracle Coherence gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle states unauthenticated network HTTPS access with easy exploitation and full takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H and unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are subject to unauthenticated remote complete system takeover (CVSS 9.8), enabling attackers to compromise data confidentiality and integrity while disrupting availability from any network position. Organizations deploying affected Coherence versions face immediate risk of data breach and operational failure without compensating controls. No vendor-released patch currently exists, making emergency containment and network isolation critical first steps.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict network access to the Coherence Core component via firewall policies to only authorized internal subnets, eliminating remote attack surface; (2) implement intrusion detection and prevention rules targeting exploitation attempts on the Core component; (3) deploy enhanced monitoring and alerting to detect anomalous connection patterns or post-compromise activity; (4) maintain 24/7 patch readiness with pre-tested deployment procedures to enable immediate deployment upon vendor patch release; (5) for highest-risk deployments, evaluate workload migration to alternative systems or version rollback to unaffected Coherence releases if available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Coherence
View allRemote takeover of Oracle Coherence (Fusion Middleware) via the Centralized Third Party Jars component allows an unauthe
Remote takeover of Oracle Coherence is possible via HTTP by an unauthenticated network attacker, affecting Oracle Fusion
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core compon
Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reach
Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion
Remote unauthenticated takeover of Oracle Coherence (Oracle Fusion Middleware) is possible over HTTPS, affecting support
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remo
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the netwo
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Co
Exploit-DB