EUVD-2026-37433Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Coherence HTTP endpoint
-
DeliverySend crafted unauthenticated HTTP request
-
ExploitTrigger Core component flaw
-
ExecutionExecute code in Coherence JVM
-
PersistPivot via scope change to host application
-
ImpactAchieve full takeover of Fusion Middleware stack
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Oracle Coherence is possible per Oracle's advisory and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). The only prerequisite is HTTP network reachability to a Coherence instance on one of the affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); no user interaction, authentication, or non-default configuration is required. Realistic limiting factors are organizational rather than technical: Coherence is typically deployed inside internal application tiers, so external exploitation depends on whether the Coherence HTTP listener is exposed beyond the data tier or proxied through a public-facing application. |
| Impact | All vendor-published signals point to maximum severity: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields a 10.0 score, Oracle classifies it as 'easily exploitable', and scope change indicates compromise extends beyond Coherence into hosting applications. EPSS and CISA KEV status are not provided in the input, and no public exploit has been identified at time of analysis, so the empirical exploitation probability cannot be quantified - however, Oracle Coherence flaws of similar profile (e.g., CVE-2020-2555, CVE-2020-14756) have historically been weaponized within weeks of disclosure. CWE classification is missing, which limits precise technical triage; defenders should treat this as priority-zero based on CVSS and the scope-change indicator regardless of the absent EPSS/KEV data. |
| Exploit ScenarioDerived | An attacker on the internet (or any network with HTTP reach to a Coherence-hosting JVM) sends a single crafted HTTP request to the vulnerable Coherence endpoint, requiring no credentials or user interaction. The request triggers code execution inside the Coherence process and, because of the scope change, the attacker pivots into the hosting WebLogic Server or co-located Fusion Middleware application - gaining full administrative control. No public exploit identified at time of analysis, but the AC:L/PR:N profile makes weaponization straightforward once technical details surface. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Remote takeover of Oracle Coherence is possible via HTTP by an unauthenticated network attacker, affecting Oracle Fusion Middleware versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw carries the maximum CVSS 3.1 base score of 10.0 with scope change, meaning successful exploitation can pivot impact into other products that rely on the Coherence cluster. No public exploit identified at time of analysis, but the trivial attack complexity and Oracle's critical scoring make this a top-priority patch item.
RemediationAI
Apply the patches distributed via Oracle's June 2026 Critical Patch Update referenced at https://www.oracle.com/security-alerts/cspujun2026.html - Patch available per vendor advisory; exact post-patch version identifiers should be taken from the CPU advisory matrix for each supported branch (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0). Until patching, restrict network reachability to Coherence HTTP management and extend endpoints to trusted management subnets via firewall or WebLogic network channel ACLs, disable any unauthenticated HTTP-accessible Coherence REST or management services, and place a reverse proxy enforcing authentication in front of Coherence-fronted applications; note these controls may break legitimate management tooling or cross-datacenter cluster traffic and are not a substitute for the CPU patch. Monitor outbound connections and JVM child-process creation from Coherence/WebLogic JVMs as a detection compensating control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Coherence is an in-memory data grid and distributed caching platform used as a clustering/state-management substrate for Oracle Fusion Middleware (WebLogic Server, SOA, WebCenter) and customer-built Java applications. The flaw resides in the Core component and is reachable over HTTP, which suggests an exposed management or cluster-protocol endpoint rather than the proprietary TCMP cluster protocol. Historically, Coherence and related Fusion Middleware components have suffered from unsafe Java deserialization (CWE-502) in T3/IIOP/HTTP listeners; with CWE unspecified here, deserialization or expression-language injection in an HTTP-accessible service is the most plausible root cause given AV:N/AC:L/PR:N and scope change to dependent products.
Know when Oracle Coherence gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Oracle advisory confirms unauthenticated HTTP exploitation with no user interaction; scope change and full takeover justify S:C and C/I/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
Oracle Coherence in Fusion Middleware versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 carries a critical vulnerability (CVE-2026-35307, CVSS 10.0) allowing unauthenticated remote network takeover with potential impact to dependent systems; no vendor patch is currently available. Organizations running affected versions face immediate risk from network-accessible instances and require urgent containment measures.
No vendor-released patch identified at time of analysis. Implement network segmentation to restrict HTTP access to Coherence clusters to trusted internal networks only; deploy firewall controls and network-based intrusion detection at cluster boundaries; enable detailed audit logging with alerting on cluster access events; disable external/internet-facing exposure of Coherence ports where feasible; maintain incident response readiness given the unauthenticated attack vector and high exploitability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Coherence
View allRemote takeover of Oracle Coherence (Fusion Middleware) via the Centralized Third Party Jars component allows an unauthe
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core compon
Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reach
Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion
Remote unauthenticated takeover of Oracle Coherence (Oracle Fusion Middleware) is possible over HTTPS, affecting support
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remo
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the netwo
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Co
Complete compromise of Oracle Coherence (Oracle Fusion Middleware Core component) is possible by unauthenticated remote
GitHub PoC
Exploit-DB