EUVD-2026-46663
GHSA-cjxw-qf69-w2xm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local logon on Coherence host
-
DeliveryInvoke vulnerable Core code path
-
ExploitCompromise Coherence process
-
ExecutionCross scope to adjacent middleware
-
ImpactFull CIA takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The exploit requires local access: the attacker must have a logon session on the infrastructure/host where Oracle Coherence executes (AV:L), consistent with Oracle's wording 'unauthenticated attacker with logon to the infrastructure where Oracle Coherence executes.' No Coherence application authentication is needed (PR:N), no user interaction is required (UI:N), and complexity is low (AC:L). The limiting factor is precisely that host-level foothold - a purely external, network-only attacker cannot trigger it without first gaining an OS logon; affected deployments are Coherence Core versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The scope change (S:C) means a successful attack can affect resources beyond Coherence on that host. |
| Impact | Signals are mixed and must be read carefully. The CVSS vector is AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (9.3): the impact is maximal and complexity is low, but the attack vector is LOCAL, not network. Oracle's description 'unauthenticated attacker with logon to the infrastructure where Oracle Coherence executes' reconciles PR:N with AV:L - no application credentials are needed, but the attacker must already have a foothold/logon on the host. This meaningfully constrains real-world risk versus a purely remote-unauthenticated flaw: it is a powerful post-access escalation/takeover primitive rather than a perimeter-breaching bug. No EPSS score was provided, it is not in CISA KEV, and no POC is referenced, so there is no evidence of active or automatable exploitation yet. Net: high intrinsic severity and 'easily exploitable' per Oracle, but the local-access prerequisite lowers likelihood compared with the raw 9.3 score - prioritize on internet-facing or multi-tenant Coherence/WebLogic hosts. |
| Exploit ScenarioDerived | An attacker who has obtained a low-level local logon on a Coherence server - for example a compromised service account, a foothold from another vulnerability, or a rogue internal user - invokes the vulnerable Core code path locally and, without needing Coherence credentials, takes over the Coherence process. Because of the scope change, that takeover is then used to impact adjacent Fusion Middleware resources on the host. No public POC is currently referenced, but Oracle rates the attack as easily exploitable with low complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Full compromise of Oracle Coherence (Fusion Middleware Core component) is possible by an unauthenticated attacker who holds a local logon on the host where Coherence runs, per Oracle's July 2026 Critical Patch Update. The flaw scores CVSS 9.3 because a successful attack yields complete confidentiality, integrity, and availability loss and, via a scope change, can significantly impact additional products beyond Coherence itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable.'
RemediationAI
Vendor-released patch: apply the Oracle Critical Patch Update of July 2026 (cpujul2026) for the affected Coherence branches (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) per https://www.oracle.com/security-alerts/cpujul2026.html - Oracle publishes exact patch/bundle numbers per version in that CPU. Because exploitation requires an interactive/logon foothold on the Coherence host, the most effective compensating controls until patching are to restrict and audit local logon rights on Coherence/WebLogic servers (remove unnecessary shell/RDP/SSH accounts), enforce least privilege and OS-level isolation for the process account, and segment these hosts so untrusted or lower-tier users cannot obtain a session; note these controls reduce but do not eliminate risk and may disrupt operational access for administrators and batch jobs. Given the scope change, also review trust relationships and shared credentials between Coherence and dependent WebLogic/Fusion Middleware components so a Coherence takeover cannot pivot laterally.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Coherence is an in-memory data grid and distributed caching/clustering platform bundled with Oracle Fusion Middleware, commonly used to scale Java (WebLogic) enterprise applications. The affected element is the Core component across supported branches 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle did not assign a CWE (CWE: N/A) and does not publish root-cause detail; the CVSS scope change (S:C) plus 'takeover' language indicates the vulnerable Coherence process can be leveraged to affect resources managed by a different security authority - consistent with Coherence's role as a clustering/serialization layer shared by other middleware. The tag 'Information Disclosure' understates the assessed impact, since all three CIA metrics are High.
Know when Oracle Coherence gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
AV:L and PR:N because a host logon is required but no Coherence auth; AC:L and S:C with full C/I/H impact per Oracle's easily-exploitable takeover with cross-product effect.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Coherence executes to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
Oracle Coherence, a critical enterprise middleware component, is affected by a CVSS 9.3 vulnerability enabling complete system compromise. An attacker with local host access can fully breach confidentiality, integrity, and availability of Coherence and potentially impact dependent systems; no public exploit identified at time of analysis. No vendor-released patch is available, creating immediate operational risk for production Coherence deployments.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict local system logon access to Coherence hosts to authorized administrators only via OS-level access controls; implement network segmentation and firewall rules to isolate Coherence node communication from untrusted network segments; deploy real-time monitoring and alerting on Coherence process execution and system-level administrative activity; consider temporary air-gapping or failover to redundant non-Coherence infrastructure for critical business functions pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Oracle Coherence
View allRemote takeover of Oracle Coherence (Fusion Middleware) via the Centralized Third Party Jars component allows an unauthe
Remote takeover of Oracle Coherence is possible via HTTP by an unauthenticated network attacker, affecting Oracle Fusion
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core compon
Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reach
Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion
Remote unauthenticated takeover of Oracle Coherence (Oracle Fusion Middleware) is possible over HTTPS, affecting support
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remo
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the netwo
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Co
Exploit-DB