Oracle Coherence EUVD-2026-46660

Exploitation requires the attacker to already have local logon access to the host where Oracle Coherence executes (AV:L) plus a valid low-privileged account (PR:L), and it additionally requires human interaction from a person other than the attacker (UI:R) - for example, an administrator or user performing an action the attacker cannot perform themselves. High attack complexity (AC:H) means conditions outside the attacker's control must align, so exploitation is not reliably repeatable. Limiting factors: no remote or unauthenticated path (not AV:N, not PR:N), mandatory victim interaction, and applicability only to Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Note that the 'Authentication Bypass' tag conflicts with PR:L and should be verified against Oracle's CPU advisory.

Signals are mixed and lean toward moderate rather than urgent priority. The CVSS 3.1 score of 7.2 (High) is driven largely by the scope change and dual C:H/I:H impacts, but the exploitability metrics temper real-world risk: AV:L requires local logon access, AC:H denotes a difficult, non-deterministic attack, PR:L requires an existing account, and UI:R requires a separate human victim to act. No EPSS score was provided, no SSVC decision was supplied, there is no POC, and the CVE is absent from CISA KEV - so no evidence of active or automatable exploitation exists. The most notable conflict is between the 'Authentication Bypass' tag and the CVSS PR:L (authenticated) metric; these contradict each other and should be verified against Oracle's advisory before treating this as an unauthenticated bypass. Net: a legitimately High-severity issue if triggered, but the compound preconditions (local access + existing privileges + victim interaction + high complexity) make widespread opportunistic exploitation unlikely.

A low-privileged user with local logon on a server running Oracle Coherence stages a crafted artifact or action and then induces a legitimate administrator or user to interact with it, exploiting the Core-component flaw to gain unauthorized read and modify access to Coherence-managed data and, via scope change, adjacent middleware. No public exploit is identified at time of analysis, and the high attack complexity means the technique is unlikely to be reliable or automatable.