EUVD-2026-37430Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Coherence HTTPS endpoint
-
DeliverySend crafted unauthenticated request
-
ExploitExploit Core component flaw
-
ExecutionAchieve Coherence takeover
-
PersistRead/modify cached data
-
ImpactPivot into Fusion Middleware tier
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Network reachability to an Oracle Coherence HTTPS-exposed endpoint on a supported version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0) is the only stated prerequisite - no authentication, no user interaction, and no special configuration are required per the CVSS vector AV:N/AC:L/PR:N/UI:N and Oracle's 'easily exploitable' wording. Realistic limiting factors: Coherence is typically deployed in internal middleware tiers behind firewalls, so exposure depends on whether HTTPS-facing Coherence or Fusion Middleware ports are reachable from the attacker's network position; instances strictly bound to private cluster networks are out of reach until an attacker first gains internal access. |
| Impact | All signals point to high real-world priority: CVSS 3.1 is 9.8 with AV:N/AC:L/PR:N/UI:N, meaning trivial network exploitation with no authentication and no user interaction, plus full C/I/A impact. Oracle's own description characterizes the flaw as 'easily exploitable' and capable of full product 'takeover', which aligns with the vector. EPSS, KEV, SSVC, and POC data are NOT provided in the input - so while the intrinsic exploitability is maximal, in-the-wild activity cannot be confirmed; no public exploit identified at time of analysis. The 'Information Disclosure' tag understates the actual impact described (full takeover), so defenders should treat this as a critical RCE-class issue and patch on Oracle CPU cadence, not as a mere info-leak. |
| Exploit ScenarioDerived | An attacker reachable on the network sends a crafted HTTPS request to an exposed Oracle Coherence endpoint and, without supplying credentials or requiring user interaction, gains control of the Coherence instance - enabling cache data theft or tampering and likely code execution within the Fusion Middleware tier. From there the attacker can pivot into application back-ends that rely on the cache for session, identity, or business state. No public exploit identified at time of analysis, but the 'easily exploitable' rating suggests weaponization is straightforward once details emerge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Remote unauthenticated takeover of Oracle Coherence (Oracle Fusion Middleware) is possible over HTTPS, affecting supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and at the time of analysis no public exploit identified at time of analysis.
RemediationAI
Apply the fixes shipped in the Oracle Critical Patch Update of June 2026 as documented at https://www.oracle.com/security-alerts/cspujun2026.html for each affected Coherence release line (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); Oracle does not generally publish standalone hotfixes outside the CPU stream, so the CPU patch is the authoritative fix. Until patching is complete, restrict network reachability of Coherence cluster, management, and extend/proxy ports (e.g., the default 9099 extend proxy and any HTTPS management endpoints) to trusted application-tier hosts via firewalls, security groups, or network segmentation - note that overly tight restrictions can break cluster member discovery and client connections, so coordinate with application owners. Where feasible, also enable Coherence's SSL/identity-based cluster authentication and disable any non-essential management or REST endpoints, accepting that this may require configuration changes to clients.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Coherence is an in-memory data grid platform within Oracle Fusion Middleware, widely used for distributed caching, low-latency data access, and cluster-wide state management in Java/JEE environments. The advisory identifies the 'Core' component as the affected subsystem, which handles fundamental clustering, serialization, and management traffic. Historically, critical Coherence vulnerabilities have stemmed from unsafe Java deserialization or remoting endpoints exposed by the cluster - root-cause classes (CWE-502 deserialization or CWE-20 input validation) are not assigned in this entry, but the CPE 'cpe:2.3:a:oracle_corporation:oracle_coherence' confirms the affected product across all listed major release lines (12.2.1.x through 15.1.1.x).
Know when Oracle Coherence gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle states unauthenticated network exploitation over HTTPS with no UI leading to full product takeover, justifying AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H; scope unchanged as impact stays within Coherence.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contain a critical vulnerability (CVSS 9.8) enabling remote unauthenticated takeover with complete impact to confidentiality, integrity, and availability; no public exploit identified at time of analysis. No vendor-released patch is currently identified, leaving affected systems permanently exposed until mitigation or upgrade. Organizations running these versions must immediately isolate infrastructure and implement compensating controls to prevent full compromise of business-critical middleware.
No vendor-released patch identified at time of analysis. Implement network segmentation restricting Coherence system access; deploy WAF rules targeting exploitation vectors; require multi-factor authentication for administrative access; enable detailed logging and monitoring of network traffic to affected systems; maintain incident response procedures for suspected compromise; plan service migration to patched infrastructure if available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Coherence
View allRemote takeover of Oracle Coherence (Fusion Middleware) via the Centralized Third Party Jars component allows an unauthe
Remote takeover of Oracle Coherence is possible via HTTP by an unauthenticated network attacker, affecting Oracle Fusion
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core compon
Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reach
Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remo
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the netwo
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Co
Complete compromise of Oracle Coherence (Oracle Fusion Middleware Core component) is possible by unauthenticated remote
GitHub PoC
Exploit-DB