EUVD-2026-46712
GHSA-v49w-fxhf-64xf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Coherence TCP port
-
DeliverySend crafted protocol message to Core
-
ExploitTrigger flaw in Coherence node
-
ExecutionExecute attacker logic in JVM
-
ImpactTake over Coherence instance and data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network TCP reachability to an Oracle Coherence listener - a cluster/TCMP socket or a Coherence*Extend proxy port on an affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0). Per CVSS AV:N/AC:L/PR:N/UI:N there are no authentication, privilege, or user-interaction prerequisites against a reachable instance. The practical limiting factor is exposure: Coherence ports are normally intended for internal/back-end networks, so an attacker must sit on a network segment (or traverse a misconfigured firewall/DMZ) that can reach the affected TCP service; instances bound only to isolated internal networks are correspondingly harder to reach. |
| Impact | All available signals point to genuine high priority rather than an inflated score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes trivial remote exploitation: network-reachable, low complexity, no privileges, no user interaction, with high impact across C/I/A, and Oracle explicitly states 'easily exploitable' and 'takeover.' Counterbalancing this, there is no EPSS score provided, no KEV listing, and no known public POC, so there is currently no evidence of active or automated exploitation despite the near-maximal severity. An SSVC-style reading gives total technical impact, currently-observed exploitation of 'none,' and plausibly high automatability given no auth/UI. The main uncertainty is exposure - Coherence cluster/Extend ports are typically intended for internal networks, so real-world risk hinges on whether the affected TCP listener is reachable from untrusted networks. Root-cause detail is missing (CWE N/A) and no independent technical write-up exists yet. |
| Exploit ScenarioDerived | An attacker who can reach a Coherence cluster or Extend proxy TCP port from an untrusted or adjacent network sends a crafted message to the exposed listener, exploiting the flaw to achieve full takeover of the Coherence process with the privileges of the hosting JVM. Because no authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N), a single reachable socket is sufficient; no public POC is currently known, so exploitation would require independent development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the network (TCP) by an unauthenticated remote attacker per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 reflects complete confidentiality, integrity, and availability loss (product takeover) with no authentication or user interaction required. No public exploit identified at time of analysis, and it is not listed in CISA KEV, so exploitation is not yet confirmed in the wild.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for each affected release train (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); Oracle does not publish standalone fixed build numbers outside the CPU, so treat patch status as 'Patch available per vendor advisory' and pull the exact patch IDs from the CPU matrix for your version. Until patched, restrict network exposure of Coherence: firewall the Coherence cluster (TCMP) and Coherence*Extend proxy TCP ports so they are reachable only from trusted application hosts, place Coherence nodes on an isolated back-end network segment, and avoid binding Extend proxies to internet- or DMZ-facing interfaces (trade-off: legitimate remote Extend clients must be explicitly allow-listed). Where supported, enable TLS/SSL and client authentication on Extend proxies and cluster socket providers to raise the bar (trade-off: certificate and configuration management overhead). These are compensating controls only and do not remove the underlying flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Coherence is a distributed in-memory data grid / caching platform used to scale stateful Java applications, frequently deployed alongside Oracle WebLogic Server within Fusion Middleware. Cluster nodes and Coherence*Extend clients communicate over TCP using Coherence's own wire protocols (TCMP and Extend), which historically transport serialized Java objects. The advisory does not assign a CWE (CWE: N/A), but the pattern of an unauthenticated network-facing TCP flaw resulting in full takeover of a Java middleware product is characteristic of insecure deserialization of untrusted data (CWE-502), which has been the root cause of prior Coherence takeover CVEs; this class attribution is inferred, not vendor-confirmed. The affected component is identified only as 'Core' (CPE cpe:2.3:a:oracle_corporation:oracle_coherence).
Know when Oracle Coherence gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle states unauthenticated network TCP exploitation is easy and yields full takeover, so AV:N/AC:L/PR:N/UI:N with high C/I/A and unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Coherence, a critical in-memory data grid component of Oracle Fusion Middleware, is exploitable by unauthenticated attackers to achieve complete system compromise. Organizations using affected Fusion Middleware deployments face immediate risk of unauthorized access to all cached data, credential exposure, and service unavailability across dependent applications. This vulnerability carries exceptional urgency due to the CVSS 9.8 critical severity rating and current absence of vendor-released fixes.
Restrict network access to Coherence ports via firewall to trusted internal IP ranges only; disable Coherence clustering features if not operationally essential to reduce the attack surface; implement network-based monitoring and alerting for unexpected connection attempts to Coherence infrastructure; isolate Coherence nodes to trusted VLANs or network segments; deploy intrusion detection signatures if published for this CVE; ensure current and tested backups are maintained to enable rapid data recovery if compromise is detected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Coherence
View allRemote takeover of Oracle Coherence (Fusion Middleware) via the Centralized Third Party Jars component allows an unauthe
Remote takeover of Oracle Coherence is possible via HTTP by an unauthenticated network attacker, affecting Oracle Fusion
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core compon
Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reach
Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion
Remote unauthenticated takeover of Oracle Coherence (Oracle Fusion Middleware) is possible over HTTPS, affecting support
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remo
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Co
Complete compromise of Oracle Coherence (Oracle Fusion Middleware Core component) is possible by unauthenticated remote
Exploit-DB