EUVD-2026-46653
GHSA-m95q-f3q8-2rj9
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Network HTTP vector with no auth required per tag; AC:H reflects documented exploitation difficulty; S:C confirmed by description's scope-change language; no availability impact stated.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Coherence accessible data as well as unauthorized read access to a subset of Oracle Coherence accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N).
AnalysisAI
Unauthenticated network exploitation of Oracle Coherence's Core component via HTTP allows partial unauthorized read and write access to Coherence-managed data, with a confirmed scope change indicating impact can extend to additional products beyond the directly targeted instance. Affecting four supported versions (12.2.1.4.0 through 15.1.1.0.0), the flaw is tagged as an Authentication Bypass, suggesting the HTTP-facing interface can be accessed without valid credentials under high-complexity attack conditions. No public exploit code has been identified at time of analysis, and Oracle disclosed this through its July 2026 Critical Patch Update.
Technical ContextAI
Oracle Coherence is an in-memory data grid and distributed caching product within the Oracle Fusion Middleware stack, commonly used in enterprise Java architectures for high-throughput session replication, distributed data management, and event-driven processing. The vulnerability resides in the Core component and is reachable over HTTP (AV:N), indicating the management API, REST endpoint, or cluster communication interface is implicated. The CVE tag 'Authentication Bypass' points to a failure in the authentication enforcement layer for one or more HTTP-exposed endpoints, allowing a remote attacker to interact with the data grid as if authenticated. The CWE is listed as N/A by the reporter, which obscures precise root-cause classification, but the combination of the Authentication Bypass tag and PR:N confirms that the auth control is missing or circumventable without credentials. The scope change (S:C) in the CVSS vector is consistent with Coherence's role as a shared data tier - compromising it can cascade to applications depending on it for cached session state or business data.
RemediationAI
Apply the Oracle Critical Patch Update for July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. The advisory covers fixes across all four affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0); the exact patched build numbers should be confirmed in the CPU patch matrix on Oracle's support portal. If immediate patching is not feasible, restrict HTTP access to Coherence management and REST interfaces at the network perimeter - block inbound HTTP to Coherence listener ports from untrusted network segments using firewall ACLs or security group rules. This reduces the attack surface but does not eliminate the underlying flaw and may affect legitimate administrative access. Additionally, place Coherence cluster nodes on isolated internal network segments rather than exposing them to internet-facing tiers. Because scope change is confirmed, prioritize patching in multi-application environments where a shared Coherence instance backs multiple services.
More in Oracle Coherence
View allRemote takeover of Oracle Coherence (Fusion Middleware) via the Centralized Third Party Jars component allows an unauthe
Remote takeover of Oracle Coherence is possible via HTTP by an unauthenticated network attacker, affecting Oracle Fusion
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core compon
Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reach
Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion
Remote unauthenticated takeover of Oracle Coherence (Oracle Fusion Middleware) is possible over HTTPS, affecting support
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remo
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the netwo
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Co
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today