EUVD-2026-46629
GHSA-x5pq-8qrf-ww5m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Coherence TCP listener
-
ExploitSend crafted network message
-
ExecutionTrigger hang/crash in Core service
-
ImpactComplete denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires TCP network reachability to an Oracle Coherence listener (cluster or proxy/Extend port) on an affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); per the CVSS vector (PR:N/UI:N/AC:L) no authentication, no user interaction, and no special non-default configuration are needed once the port is reachable. The primary limiting factor is network exposure: Coherence ports are normally intended to be internal, so exploitation depends on the attacker having a path to the listener - a segmented, firewalled deployment sharply limits reachability, while any internet- or broad-LAN-exposed instance is directly at risk. Impact is bounded to availability (hang/crash); it cannot be used to read data or execute code. |
| Impact | The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is internally consistent and describes a low-complexity, unauthenticated, network-reachable DoS with high availability impact and no confidentiality or integrity loss - Oracle's own 'easily exploitable' wording reinforces AC:L/PR:N. The 7.5 score is driven entirely by availability; there is no code execution or data exposure. No EPSS score, POC, or KEV entry was supplied, so exploitation probability cannot be quantified from the input and there is no public exploit identified at time of analysis. Real-world priority hinges on exposure: Coherence cluster/proxy ports are typically meant to be internal, so internet-exposed instances are the acute risk while segmented deployments face lower practical risk despite the network vector. Treat as a high-value patch for exposed or availability-sensitive systems, but note the impact ceiling is service outage, not compromise. |
| Exploit ScenarioDerived | An attacker who can reach a Coherence TCP listener sends a crafted or malformed network message that drives the Core service into a hang or repeatable crash, taking the node - and potentially dependent middleware relying on the cache - offline. Because no authentication or user interaction is required and complexity is low, the request can be scripted and replayed to keep the service down. No public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Denial-of-service in Oracle Coherence (Core component of Oracle Fusion Middleware) lets an unauthenticated attacker with TCP network access hang or repeatably crash the data-grid service, producing a complete availability outage. It affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 and is rated CVSS 3.1 7.5 (availability-only). Oracle labels it easily exploitable, but there is no public exploit identified at time of analysis and it is not on CISA KEV.
RemediationAI
Apply the fixes from the Oracle July 2026 Critical Patch Update as the primary remediation - Patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html; the input does not include an exact fixed build number, so consult that CPU matrix for the patch corresponding to your version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0). Until patched, reduce exposure by restricting network reachability of Coherence cluster and proxy/extend TCP listener ports to trusted management and application subnets via firewall/security-group rules and network segmentation, which blunts unauthenticated remote access with minimal functional trade-off for properly-tiered deployments; if any Coherence port is internet-exposed, block it at the perimeter immediately. Ensure clustered redundancy and monitoring/auto-restart of Coherence nodes so a triggered hang or crash degrades gracefully rather than causing total outage, accepting that this mitigates impact but does not prevent the DoS.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Coherence is an in-memory distributed data grid used to cache and share application state across clustered Java middleware (often behind WebLogic and Fusion Middleware stacks), exposing cluster and proxy services over TCP. The flaw sits in the product's Core component, which handles cluster membership, serialization and network message processing. Oracle does not map a CWE (listed N/A), but the availability-only, no-integrity/no-confidentiality profile is consistent with a crash-inducing input-handling defect (e.g., malformed packet or request that triggers an unhandled condition or resource exhaustion in the network listener), placing it in the CWE-400/CWE-248-style denial-of-service class rather than a memory-corruption/RCE class.
Know when Oracle Coherence gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated, low-complexity network access to a TCP listener (AV:N/AC:L/PR:N/UI:N) causing service-only crash with no data impact, so C:N/I:N/A:H, S:U.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Executive ViewAI
Oracle Coherence, critical distributed data infrastructure used across the enterprise, faces a denial-of-service vulnerability affecting supported versions 12.2.1.4.0 through 15.1.1.0.0 that enables unauthenticated attackers to completely disable the service via network access. Absent a vendor patch, organizations must deploy immediate network-based mitigations to protect real-time data operations from external outage attacks.
No vendor-released patch identified at time of analysis. Implement strict network segmentation to limit Coherence cluster access to trusted systems only; deploy network-based intrusion detection with alerts for unauthorized connection attempts; restrict administrative access to Coherence management interfaces; maintain tested failover procedures and ensure rapid recovery capabilities are validated and ready for deployment; establish 24/7 monitoring for anomalous cluster behavior.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Coherence
View allRemote takeover of Oracle Coherence (Fusion Middleware) via the Centralized Third Party Jars component allows an unauthe
Remote takeover of Oracle Coherence is possible via HTTP by an unauthenticated network attacker, affecting Oracle Fusion
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core compon
Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reach
Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion
Remote unauthenticated takeover of Oracle Coherence (Oracle Fusion Middleware) is possible over HTTPS, affecting support
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remo
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the netwo
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Co
Exploit-DB