Oracle Coherence EUVD-2026-37434

Attacker needs network reachability to an HTTP endpoint served by, or fronting, the Oracle Coherence 'Centralized Third Party Jars' component on a vulnerable build (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0); no authentication, no user interaction, and no special configuration toggle are called out by Oracle as prerequisites. Practical limiters are that Coherence is typically deployed inside enterprise data-tier networks rather than directly internet-exposed, so reachability of the HTTP listener (whether the Coherence REST/management interface or a WebLogic-hosted application path that reaches the vulnerable jar code) from the attacker's vantage point is the gating condition. Versions outside the four listed supported releases and patched builds from the June 2026 CPU are not exploitable.

All available signals point to top-tier risk: CVSS 3.1 base score is the maximum 10.0 with AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, meaning remote, unauthenticated, low-complexity exploitation with full CIA impact and scope change to neighboring components. Oracle's own description characterizes the issue as 'easily exploitable' and resulting in 'takeover', which aligns with the vector. However, several real-world risk modulators are unavailable in the provided intelligence: there is no EPSS score, no CISA KEV listing, no public POC, and no SSVC decision. Given Coherence's typical deployment behind enterprise perimeters (rarely directly internet-exposed) and the absence of public exploit code at this time, immediate mass-exploitation risk is likely lower than the 10.0 suggests, but the issue should still be treated as a top-priority patch for any Fusion Middleware estate because Oracle CPU vulnerabilities historically attract exploit development within weeks. The 'Information Disclosure' tag conflicts somewhat with the description's 'takeover' language and C:H/I:H/A:H vector - verify with Oracle's CPU advisory which impacts are actually achievable.

An attacker with HTTP reachability to an Oracle Coherence instance - for example, a Fusion Middleware host whose management or application HTTP endpoint is exposed to a corporate network or, in misconfigured cases, the internet - sends a crafted HTTP request to the vulnerable Centralized Third Party Jars handler. Because exploitation requires no authentication and no user interaction (PR:N/UI:N) and complexity is low (AC:L), a successful request leads to full takeover of the Coherence service and, due to scope change, compromise of co-hosted Fusion Middleware components such as WebLogic. No public exploit identified at time of analysis, but the Oracle-confirmed 'easily exploitable' wording suggests exploit code is likely to follow the CPU release.