EUVD-2026-46705
GHSA-w2jf-9c99-w76q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Coherence HTTP service
-
DeliverySend crafted request to Core component
-
ExploitTrigger unauthenticated flaw
-
ExecutionAchieve control of Coherence process
-
ImpactExfiltrate or tamper with grid data / DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond network reachability - remote unauthenticated exploitation over HTTP against affected Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is network exposure: the attacker must be able to reach the Coherence Core/proxy service, so instances confined to segmented internal networks and unreachable from untrusted zones are substantially harder to attack. Exploitation is bounded to the listed supported versions; unlisted or already-patched builds are out of scope. |
| Impact | This is a genuine top-priority issue rather than an inflated CVSS number. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects remote, low-complexity, unauthenticated exploitation with full confidentiality, integrity, and availability impact, and Oracle explicitly labels it 'easily exploitable' with 'takeover' as the outcome. No EPSS score, SSVC decision, KEV entry, or public POC is present in the provided intelligence, so exploitation is currently theoretical from a public-signal standpoint - but the low barrier to exploitation (no auth, no user interaction) means weaponization risk is high once details or patches are reverse-engineered. Note a minor conflict: the source Tags label this 'Information Disclosure,' while Oracle's own description states full 'takeover' with C/I/A all High - treat the CVSS/description (takeover) as authoritative over the coarse tag. |
| Exploit ScenarioDerived | An attacker with network reachability to a Coherence instance sends a crafted HTTP request to the exposed Core/proxy service and, without any credentials or user interaction, gains control over the Coherence process, allowing data theft, tampering with cached/grid data, and denial of service. Because attack complexity is low and no authentication is required, this could be scripted for opportunistic scanning of exposed middleware. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Complete compromise of Oracle Coherence (Oracle Fusion Middleware Core component) is possible by unauthenticated remote attackers sending crafted HTTP traffic, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 9.8 and results in full takeover of the Coherence data-grid instance across affected versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (Patch available per vendor advisory; an exact standalone fix version is not enumerated in the provided data) documented at https://www.oracle.com/security-alerts/cpujul2026.html, prioritizing this update given the 9.8 severity and unauthenticated network vector. Until patching is complete, restrict network exposure of Coherence cluster and Extend/proxy ports so they are reachable only from trusted application tiers via firewall or security-group rules, place Coherence behind a segmented internal network rather than any internet-facing path, and enforce Coherence Extend TCP-only proxies with authentication/TLS where supported - noting that tightening proxy access or blocking ports can disrupt legitimate cross-tier caching and cluster traffic and should be validated against application dependencies. Do not rely on the coarse 'Information Disclosure' tag to downgrade urgency; the vendor describes full takeover.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Coherence is an in-memory distributed data-grid and caching platform bundled with Oracle Fusion Middleware, commonly deployed alongside WebLogic to provide clustering, session replication, and low-latency caching for enterprise Java applications. The vulnerable 'Core' component handles cluster communication and remote client/extend proxy requests over the network. Oracle did not assign a CWE (listed as N/A), but the combination of an unauthenticated, network-reachable HTTP vector resulting in full takeover is characteristic of unsafe deserialization or remote-object/method invocation flaws historically seen in Coherence and other Fusion Middleware components; the exact root-cause class is not disclosed in the available data.
Know when Oracle Coherence gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle describes easily exploitable unauthenticated HTTP-based takeover with full C/I/A impact, giving AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are vulnerable to unauthenticated remote complete system compromise (CVSS 9.8) via malicious HTTP requests. An attacker can seize full control of the data-grid infrastructure without requiring credentials, compromising all stored data and dependent applications. Organizations using affected Coherence versions face immediate risk of data loss, service disruption, and potential regulatory breach.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to affected Coherence instances to authorized internal networks only, blocking all external and untrusted traffic at the firewall; (2) Deploy Web Application Firewall with signatures blocking malformed HTTP traffic; (3) Implement aggressive rate limiting and connection controls on Coherence listening ports; (4) Enable comprehensive audit logging for all Coherence data-grid access with real-time alerting on suspicious activity; (5) Segment affected systems into isolated network zones with no internet egress; (6) Evaluate emergency data migration options to alternative data-grid solutions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Coherence
View allRemote takeover of Oracle Coherence (Fusion Middleware) via the Centralized Third Party Jars component allows an unauthe
Remote takeover of Oracle Coherence is possible via HTTP by an unauthenticated network attacker, affecting Oracle Fusion
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core compon
Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reach
Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion
Remote unauthenticated takeover of Oracle Coherence (Oracle Fusion Middleware) is possible over HTTPS, affecting support
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remo
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the netwo
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Co
Exploit-DB