Oracle Coherence EUVD-2026-46655

The one hard prerequisite is TCP network reachability to an affected Oracle Coherence instance's Core/cluster or Extend proxy service (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0). No authentication and no user interaction are required (PR:N/UI:N), and complexity is low (AC:L), so default, unpatched, network-exposed instances are exploitable. The practical limiting factor is exposure scope: Coherence ports are typically bound to internal application-tier networks rather than the public internet, so realistic risk concentrates on attackers who already have footing on the same network segment or on deployments that improperly expose cluster/Extend ports beyond the trusted tier. Exploitation is limited to the listed supported versions on the Core component.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) indicates the strongest possible exploitability profile: remote, low complexity, no privileges, no user interaction, with full CIA impact - Oracle itself labels it 'easily exploitable.' This aligns with a real, high-priority risk rather than a high-CVSS-but-low-real-risk theoretical issue. However, no EPSS score, no POC, and no CISA KEV listing are present in the input, so probability-of-exploitation and active-exploitation signals are currently unquantified - absence of these signals is not evidence of low risk given the vector. One inconsistency to verify: the description states full 'takeover' with I:H/A:H, yet the intelligence Tags list only 'Information Disclosure'; the CVSS vector (which includes I:H and A:H) should be treated as authoritative over the tag, and the tag likely reflects incomplete enrichment. Because SSVC/automatable and EPSS fields are missing, treat prioritization off the CVSS vector: unauthenticated internet- or intranet-reachable Coherence instances warrant emergency patching.

An attacker with TCP reachability to a Coherence cluster or Extend proxy port sends a crafted request to the exposed Core service and, without any credentials or user interaction, gains control of the Coherence node - reading or altering cached data and executing attacker-controlled logic on the JVM. Given AC:L and PR:N, this requires only network access and low skill; no public exploit is identified at time of analysis, so an attacker would need to develop the technique or await a published POC.