Oracle Coherence EUVD-2026-46615

Oracle Coherence (versions 12.2.1.4.0-15.1.1.0.0) can be remotely compromised without authentication, enabling complete system takeover via a CRITICAL vulnerability with 9.8 severity. Any organization running these versions faces immediate risk of data breach, operational disruption, and full infrastructure compromise. No vendor patch is currently available, making this a critical infrastructure protection priority.

Within 24 hours: Identify all systems running vulnerable Coherence versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) across Oracle Fusion, WebLogic, and Coherence deployments, document their network exposure, and escalate to your Oracle support account for patch timeline confirmation. Within 7 days: Implement firewall rules restricting Coherence cluster ports (typically 7574 and 9099) to only trusted internal networks, enable comprehensive logging and alerting on all Coherence traffic for anomaly detection, and assess business criticality of each instance to determine if temporary shutdown is feasible to reduce attack surface. Within 30 days: Maintain weekly contact with Oracle support for patch status, establish and test incident response procedures for compromise scenarios, and prepare a staged patching plan for immediate deployment upon vendor release.

No vendor-released patch identified at time of analysis. Implement mitigations: restrict network access to Coherence ports (7574, 9099) to internal trusted IP ranges via firewall rules; require VPN or bastion host authentication for all administrative access; deploy network IDS/IPS rules to detect protocol anomalies and unusual API activity; implement detailed API logging and behavioral analytics to identify exploitation attempts; prepare forensic tools and incident response procedures for rapid deployment if compromise is detected; evaluate operational necessity of each Coherence cluster to determine if temporary service shutdown reduces risk exposure until patching is available.