Oracle Coherence EUVD-2026-46627

Exploitation requires network TCP reachability to the Oracle Coherence Core component on an affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0); per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no special conditions - remote unauthenticated exploitation is possible with no authentication and no user interaction. The main limiting factor is network exposure: Coherence cluster/Extend ports are frequently bound to internal or management networks rather than the public internet, so realistic risk hinges on whether an attacker can reach those TCP ports. Only the four named supported versions are stated as affected.

All available signals point to high real-world risk: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes network-reachable, low-complexity, unauthenticated exploitation with total impact to confidentiality, integrity, and availability, and Oracle itself characterizes the flaw as 'easily exploitable.' No EPSS score, SSVC decision, KEV listing, or POC was supplied, so exploitation probability cannot be quantified from the input; the absence of these signals should not be read as low risk given the vector. One inconsistency to verify: the advisory tags say 'Information Disclosure,' whereas the description says the attack results in 'takeover of Oracle Coherence' (C:H/I:H/A:H) - the CVSS impact metrics and prose take precedence, so this should be treated as a full-compromise vulnerability, not merely disclosure. This is a genuine priority rather than a high-CVSS-but-low-real-risk case, primarily because Coherence's clustering ports are often reachable from internal networks and the exploit requires no authentication or user interaction.

An attacker who can reach a Coherence node's TCP cluster or Extend port from the internal network (or an exposed perimeter) sends a crafted request to the Core component and, without any credentials or user interaction, achieves takeover of the Coherence instance and the data grid it serves. Given the low attack complexity Oracle describes, exploitation would likely be scriptable once technical details are public, though no public POC is currently identified.