Oracle Coherence EUVD-2026-46616

Exploitation requires TCP network reachability to an affected Oracle Coherence node (versions 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0) - specifically to the Core component's cluster/proxy listener. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no elevated privileges, and no user interaction are required, so no special conditions apply beyond network access to a default-configured, unpatched Coherence Core listener. The primary limiting factor is network position: Coherence listener ports are typically internal cluster/application-tier ports rather than internet-facing, so realistic exploitation depends on the attacker already having access to the network segment where Coherence nodes accept TCP connections. Firewalling or segmenting those ports meaningfully constrains exploitation despite the high raw CVSS score.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case exploitation profile: remote, unauthenticated, low-complexity, no user interaction, with High impact to all three security properties - a textbook 9.8 pre-auth takeover. Weighing other signals tempers immediate urgency: no EPSS score was provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no public exploit or POC is identified at time of analysis. The Oracle-supplied 'Information Disclosure' tag conflicts with the description's 'takeover' and full I/A impact - the CVSS vector and description should be treated as authoritative over the tag, which appears under-scoped. Net assessment: this is a genuine high-priority issue because of trivial exploitability and unauthenticated network exposure, but exploitation is currently theoretical rather than observed; prioritize patching internet- or broadly-network-exposed Coherence/WebLogic clusters first.

An attacker who can reach a Coherence node's TCP listener port from a reachable network segment sends a crafted request to the Core component and, without any credentials or user interaction, triggers the takeover condition to run code or fully control the Coherence process. Because attack complexity is low and no authentication is needed, a single well-formed connection can be sufficient. No public POC or exploit is identified at time of analysis, so exploitation would currently require independent development.