EUVD-2026-46722
GHSA-7vpj-pj35-grhx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible HTTP vector with low-privilege requirement; partial confidentiality loss only, no integrity or availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Coherence accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
AnalysisAI
Unauthorized data read in Oracle Coherence Core component affects all four supported release lines (12.2.1.4.0 through 15.1.1.0.0) via HTTP, allowing a low-privileged network attacker to access a subset of cached data without proper authorization. The vendor-assigned 'Authentication Bypass' tag suggests the root cause is an authorization control deficiency in the HTTP-facing Core layer rather than a complete absence of authentication - low-privilege credentials appear sufficient to bypass higher-tier access controls. No public exploit or active exploitation has been identified at time of analysis; EPSS data was not provided in the input.
Technical ContextAI
Oracle Coherence is an in-memory data grid and distributed caching product within the Oracle Fusion Middleware stack, widely deployed in enterprise Java environments for high-performance data access and clustering. The vulnerability is rooted in the Core component and is reachable over HTTP, which aligns with Coherence's HTTP-based management console and REST data access interfaces. CPE cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:* covers all listed affected versions. No CWE has been assigned by NVD or Oracle, which limits root-cause classification; however, the 'Authentication Bypass' vendor tag combined with a PR:L CVSS metric strongly implies an authorization bypass (CWE-285 or CWE-863 family) rather than a complete authentication circumvention - a low-privileged principal appears able to access data scoped to higher-privileged roles. The CVSS S:U (unchanged scope) confirms the impact is contained to the Coherence system itself.
RemediationAI
Apply Oracle's Critical Patch Update for July 2026, available via the Oracle Security Alerts portal at https://www.oracle.com/security-alerts/cpujul2026.html. The advisory contains patch instructions and My Oracle Support notes for each affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0); an exact patched build version was not independently confirmed from available input data - consult the Oracle advisory directly for the specific patch identifier. As a compensating control where patching is delayed, restrict network access to Coherence HTTP management and data REST endpoints to trusted administrative networks or VPN-authenticated segments only, which reduces the attack surface given the AV:N/PR:L exploitation path. Note that restricting HTTP access may impact applications that depend on Coherence's HTTP-based APIs.
More in Oracle Coherence
View allRemote takeover of Oracle Coherence (Fusion Middleware) via the Centralized Third Party Jars component allows an unauthe
Remote takeover of Oracle Coherence is possible via HTTP by an unauthenticated network attacker, affecting Oracle Fusion
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core compon
Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reach
Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion
Remote unauthenticated takeover of Oracle Coherence (Oracle Fusion Middleware) is possible over HTTPS, affecting support
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remo
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the netwo
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Co
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today