EUVD-2026-37435Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Coherence HTTP listener
-
DeliverySend crafted HTTP request to Third Party Jars endpoint
-
ExploitTrigger unauthenticated code path
-
ExecutionExecute arbitrary code as service user
-
PersistEstablish persistence in middleware tier
-
ImpactPivot to cached data and cluster nodes
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector AV:N/AC:L/PR:N/UI:N, no special conditions are required beyond network HTTP reachability to an Oracle Coherence instance running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0; the attacker needs neither credentials nor user interaction. The practical limiting factor is exposure of the Coherence HTTP listener or management endpoint - many production deployments place Coherence behind perimeter controls on internal management VLANs, so internet-facing exposure is the dominant risk gate, while internal-network attackers face no meaningful barrier. |
| Impact | All CVSS signals point to maximum real-world risk: AV:N/AC:L/PR:N/UI:N means a remote, unauthenticated attacker can exploit the issue over HTTP without user interaction or special conditions, and C:H/I:H/A:H confirms full system takeover. EPSS and CISA KEV data were not provided in the input, so exploitation-in-the-wild status cannot be confirmed at this time - however, Oracle Coherence has a documented history of being targeted (multiple prior Coherence deserialization CVEs reached KEV), so absence of KEV listing today should not be read as low risk. The vendor's own characterization as 'easily exploitable' aligns with the CVSS vector, and the 9.8 score is internally consistent with the description; there is no apparent conflict between data sources. Treat this as a priority-patch item for any externally reachable Coherence deployment. |
| Exploit ScenarioDerived | An attacker scans for internet-reachable or internally exposed Oracle Coherence HTTP endpoints, then issues a single crafted HTTP request to the vulnerable Centralized Third Party Jars-handled path, achieving remote code execution as the Coherence/WebLogic process user and pivoting into cached business data, credentials, and the broader Fusion Middleware cluster. No authentication, user interaction, or chained vulnerabilities are required, and given Coherence's deployment role in financial, telecom, and government middleware stacks, a successful compromise typically yields high-value access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion Middleware deployments running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0. The flaw resides in the Centralized Third Party Jars component and carries a critical 9.8 CVSS score with full confidentiality, integrity, and availability impact; no public exploit identified at time of analysis, but the trivial attack profile and Oracle's CPU disclosure pattern make weaponization likely.
RemediationAI
Apply the Oracle Critical Patch Update for June 2026 as documented at https://www.oracle.com/security-alerts/cspujun2026.html - the advisory ships fixes for all four affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); patch available per vendor advisory, though specific post-patch version strings are not enumerated in the source data and should be confirmed against the CPU patch matrix. If patching cannot be performed immediately, restrict network reachability of Coherence HTTP management and cluster ports (default management REST on 30000/HTTP, Extend proxy listeners, and any custom HTTP endpoints) to trusted management subnets only via firewall ACLs, which will break remote client/admin access from outside the allowlisted range. Where Coherence is fronted by an application server, disable or remove unused HTTP listeners and Centralized Third Party Jars-exposed endpoints, accepting that any client relying on those endpoints will lose connectivity until patched.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Coherence is an in-memory data grid platform used in Fusion Middleware deployments for distributed caching, computation, and event processing across clustered Java application servers. The vulnerable component, 'Centralized Third Party Jars,' refers to bundled third-party library dependencies shipped with Coherence - historically this packaging has been the source of deserialization and library-level flaws (e.g., prior Coherence CVEs tied to Java serialization in T3/IIOP/HTTP listeners). No CWE is assigned in the source data, but the CVSS profile (network, low complexity, no auth, full CIA impact, scope unchanged) combined with the 'Centralized Third Party Jars' surface is consistent with an unsafe-deserialization or expression-injection class flaw exposed over an HTTP endpoint.
Know when Oracle Coherence gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor confirms unauthenticated network HTTP exploitation with low complexity and no user interaction, resulting in full product takeover, justifying PR:N/UI:N and C/I/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Coherence (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) contains a critical remote code execution vulnerability affecting all Fusion Middleware deployments with HTTP network exposure. An unauthenticated attacker can achieve complete system compromise without credentials or special access. This poses immediate risk to any organization running these versions with internet or untrusted network connectivity.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict HTTP network access to Coherence endpoints via firewall or WAF to known administrative IP ranges only; (2) Disable remote administrative access where functionally possible; (3) Network segmentation to isolate affected Coherence instances from untrusted networks and the internet; (4) Enhanced monitoring and logging of HTTP requests to affected instances; (5) Prepare for business continuity scenarios if compromise occurs; (6) Monitor Oracle CPU advisories and security feeds for patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Coherence
View allRemote takeover of Oracle Coherence (Fusion Middleware) via the Centralized Third Party Jars component allows an unauthe
Remote takeover of Oracle Coherence is possible via HTTP by an unauthenticated network attacker, affecting Oracle Fusion
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core compon
Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reach
Remote unauthenticated takeover of Oracle Coherence (Oracle Fusion Middleware) is possible over HTTPS, affecting support
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remo
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the netwo
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Co
Complete compromise of Oracle Coherence (Oracle Fusion Middleware Core component) is possible by unauthenticated remote
GitHub PoC
Exploit-DB