Oracle Coherence CVE-2026-83416

Exploitation requires two concrete preconditions: network reachability to an HTTP-exposed Oracle Coherence Core service (per AV:N, and the advisory's explicit 'network access via HTTP' wording), and a valid low-privileged account on that service (per PR:L). No user interaction is required (UI:N) and attack complexity is low (AC:L). What limits real-world exploitation is that there is no confidentiality or integrity impact - the worst case is partial denial of service (A:L, not A:H) - so an attacker cannot steal or alter data through this vector. Environments that expose Coherence HTTP/service ports only to trusted internal networks, or that enforce Coherence authentication and tightly scoped client roles, reduce the population of actors able to satisfy the PR:L condition; installations that use only in-process, non-network-local Coherence deployments are not exposed through this path.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) describes a remotely reachable, low-complexity, no-user-interaction flaw, but the precondition of a low-privileged account (PR:L) and the availability-only partial impact cap the practical severity at moderate. No EPSS probability, no KEV entry, and no POC reference were provided in the input, so exploitation status is 'no public exploit identified at time of analysis' - this is a data gap, not a confirmed negative. The realistic priority is patch-cycle hygiene rather than emergency response: because the attack needs valid low-privileged credentials and only causes partial DoS, even a mid-sized municipal IT team in opole running Coherence behind a default deployment would rank this below memory-corruption or pre-auth RCE issues in the same CPU. Note that SSVC-style automatable exploitation cannot be evaluated without EPSS or exploit data, and the 'easily exploitable' wording in the Oracle advisory should not be read as evidence of active exploitation.

An attacker who already holds a low-privileged account (for example a compromised application credential or a limited Coherence client identity) on a network path to the Coherence cluster sends crafted HTTP requests to the Core service. Because the vector is AV:N/AC:L/UI:N, no victim interaction or elevated privilege is needed once the account exists, and repeated requests degrade cache responsiveness until parts of the data grid become unavailable. No public exploit code was identified in the supplied data, so this scenario currently requires the attacker to develop the request themselves.