Oracle Coherence EUVD-2026-46650

Exploitation requires only network/TCP reachability to a listening Oracle Coherence Core service on version 15.1.1.0.0 - per the CVSS vector AV:N/AC:L/PR:N/UI:N there is no authentication or user interaction requirement, so no special conditions beyond reaching an exposed Coherence listener port against a default-affected deployment. What limits exploitation in practice is network exposure: Coherence grids are commonly deployed on internal/segmented back-end networks, so an attacker must already have a route to the cluster's TCP ports (e.g., Extend proxy or TCMP), and only the specific supported version 15.1.1.0.0 is named as affected.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H yields 8.6, driven by unauthenticated network reachability, low complexity, and a high availability impact (complete DOS) plus partial confidentiality and integrity loss. Oracle explicitly calls it 'easily exploitable,' reinforcing the AC:L/PR:N reading. However, no EPSS score, SSVC decision, KEV entry, or POC was provided, so real-world exploitation likelihood cannot be quantified from the data - the high score reflects potential, not observed, activity. The dominant impact is availability: an attacker most reliably achieves a hang or repeatable crash, with data read/modify limited to 'a subset' / 'some' of accessible data, so treat this primarily as a DoS risk to any Coherence cluster whose TCP ports are network-reachable. Priority should be scaled by exposure: internet- or broadly-network-exposed Coherence listeners warrant urgent patching, while tightly segmented internal grids are lower urgency despite the high base score.

An attacker who can reach a Coherence TCP listener port sends crafted network traffic to the grid and triggers a hang or repeatedly crashing condition, taking the cache/cluster offline (complete DOS) for dependent Fusion Middleware applications. The same access can be leveraged to read a subset of, and insert/update/delete some of, the data the grid manages. No credentials or user interaction are required, though no public POC has been identified at time of analysis.