Oracle Coherence EUVD-2026-46634

Exploitation requires only TCP network access to an Oracle Coherence Core listener (cluster/TCMP or Coherence*Extend proxy port) on an affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0); per CVSS AV:N/AC:L/PR:N/UI:N there are no authentication, privilege, or user-interaction prerequisites against a reachable instance. The primary limiting factor is network exposure: Coherence is typically deployed on internal application-tier segments, so risk is highest where cluster/extend ports are reachable from untrusted networks or a compromised internal host; network segmentation or a firewall blocking the listener effectively prevents remote reach. Being on an unpatched affected version is the other hard requirement.

This is a genuine high-priority issue rather than an inflated high-CVSS score: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network-reachable, low-complexity, unauthenticated exploitation with no user interaction and full CIA impact, and Oracle explicitly rates the vulnerability 'easily exploitable' resulting in product takeover. Mitigating the urgency, there is no EPSS score provided, the vulnerability is not in CISA KEV (no confirmed active exploitation), and no public POC is referenced, so exploitation appears theoretical to targeted at this time rather than mass-automated. The one point of tension to verify is signal-versus-tag: the metadata tag says 'Information Disclosure,' yet the vector and Oracle's own text assert a full takeover with high integrity and availability impact - the takeover framing should be treated as authoritative and the tag as an under-description. Given a widely deployed enterprise middleware component and a trivial exploitation profile, defenders should treat this as a priority patch despite the absence of KEV/EPSS/POC data.

An attacker with TCP reachability to an exposed Oracle Coherence cluster or extend proxy port sends a crafted request to the Core listener and, without any credentials or user interaction, achieves full compromise of the Coherence instance. Because Oracle rates the flaw 'easily exploitable' with low attack complexity, a single unauthenticated network interaction is sufficient to take over the service and its cached data. No public exploit code is currently identified, so an attacker would need to develop the exploit independently.