Oracle Coherence EUVD-2026-46603

Exploitation requires network TCP reachability to an Oracle Coherence Core listener - typically the cluster (TCMP) port or a Coherence*Extend proxy port - on one of the affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are documented as prerequisites, so this is effectively unauthenticated remote exploitation of a reachable Coherence instance. The primary limiting factor is network exposure: environments that keep Coherence cluster/proxy ports on isolated internal segments substantially reduce reachable attack surface, whereas any internet- or untrusted-network-exposed proxy is directly at risk.

This is a genuine high-priority issue rather than an inflated CVSS number: the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes network-reachable, low-complexity, unauthenticated exploitation with full CIA impact, and Oracle explicitly calls it 'easily exploitable,' which aligns with a real automatable threat. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability and active-exploitation status cannot be quantified - treat this as high-severity-by-signal but unproven-in-the-wild. One data inconsistency to verify: the intelligence Tags label this 'Information Disclosure,' while the description states full 'takeover' with H/H/H impact; the description and CVSS should be treated as authoritative and the tag as an under-classification. Because Coherence proxy/cluster ports are often internally exposed, real-world risk depends heavily on whether the listener is reachable from untrusted networks.

An attacker with TCP reachability to a Coherence cluster or Coherence*Extend proxy port sends a crafted request to the exposed Core listener without any credentials, triggering the flaw to gain code execution or full control of the Coherence process. Because no user interaction or authentication is needed and complexity is low, this could be scripted against exposed instances; however, no public POC or active exploitation has been identified at time of analysis.