EUVD-2026-46668
GHSA-wxgc-m284-52jc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Coherence TCP listener
-
DeliverySend crafted request to Core component
-
ExploitAbuse flaw without authentication
-
ExecutionAchieve remote takeover of Coherence instance
-
ImpactAccess/alter grid data and cluster
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network TCP reachability to an Oracle Coherence listener - the cluster communication port or a Coherence*Extend proxy service - on an affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no special configuration, and no user interaction are needed against a reachable instance. The primary limiting factor is exposure: Coherence ports are often bound to internal cluster networks, so an attacker must be able to route TCP to the listener; the input does not specify whether a non-default configuration (e.g., an externally bound Extend proxy) is required, so the exact exposed surface should be verified against your deployment. |
| Impact | This is a genuine high-priority issue rather than an inflated CVSS score. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes network-reachable, low-complexity exploitation with no privileges and no user interaction, and Oracle's own text calls it 'easily exploitable' with 'takeover' impact - the strongest possible combination for a remote target. That said, no EPSS probability, SSVC decision, POC, or KEV listing was supplied in the input, so real-world exploitation is currently unconfirmed; the score reflects potential, not observed, attacks. The main mitigating reality is exposure: Coherence cluster/proxy ports are frequently restricted to internal networks, so external risk depends heavily on whether the listener is reachable from untrusted networks. Treat as urgent for any internet- or DMZ-exposed Coherence instance; still important but lower-urgency for well-segmented internal clusters. |
| Exploit ScenarioDerived | An attacker who can reach an exposed Oracle Coherence TCP listener (cluster port or Coherence*Extend proxy) from the network sends crafted traffic that abuses the Core component to gain control of the instance without any credentials or user interaction. Given the CVSS AV:N/AC:L/PR:N profile and Oracle's 'easily exploitable / takeover' language, a single successful request path could yield full compromise of the Coherence data grid. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Full compromise of Oracle Coherence, the in-memory data grid component of Oracle Fusion Middleware (Core), allows an unauthenticated remote attacker with only TCP network access to take over the affected instance. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, it affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and was disclosed by Oracle in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided in the input.
RemediationAI
Apply the Oracle July 2026 Critical Patch Update fixes for Oracle Coherence as documented at https://www.oracle.com/security-alerts/cpujul2026.html, which covers versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0; Oracle does not publish a single fix build in the input, so consult the CPU patch matrix for the exact patch/bundle for your version (Patch available per vendor advisory). Until patching completes, restrict network reachability of Coherence cluster and Coherence*Extend proxy TCP ports to trusted hosts only via firewall/security-group rules and network segmentation, since the vector is unauthenticated TCP - the trade-off is that overly broad blocking can break legitimate cluster members or extend clients, so scope rules to known peer addresses. Where feasible, place Coherence behind a VPN/internal-only boundary and disable or lock down any externally exposed proxy service; these controls reduce exposure but are not a substitute for the CPU patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Coherence is a distributed in-memory data grid and caching platform used to scale stateful applications across a cluster, typically deployed as part of Oracle Fusion Middleware and WebLogic Server environments. Cluster members communicate over TCP (and Coherence*Extend proxy services), and historically the highest-severity Coherence flaws have stemmed from unsafe deserialization of cluster or client traffic reaching an exposed listener. Oracle attributes this to the 'Core' component and classifies impact as 'takeover of Oracle Coherence,' but the specific root-cause class is not published - the CWE is listed as N/A in the input, so the exact weakness (e.g., deserialization or authentication bypass) cannot be confirmed from the provided data.
Know when Oracle Coherence gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle states easily exploitable unauthenticated network TCP takeover with full CIA impact, so AV:N/AC:L/PR:N/UI:N and C/I/A:H; scope unchanged as compromise stays within Coherence.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
A critical vulnerability in Oracle Coherence enables complete system compromise through unauthenticated remote access, affecting organizations running Oracle Fusion Middleware versions 12.2.1.4.0 through 15.1.1.0.0. With no security patch currently available, affected organizations face an urgent need to secure these systems through network controls or reduce operational exposure. This poses an immediate risk to data confidentiality, integrity, and system availability across deployments relying on Coherence for in-memory data processing.
Implement network segmentation to restrict access to affected Coherence instances to only necessary internal systems; configure strict firewall rules limiting TCP access to authorized sources; disable unnecessary remote ports and administrative interfaces; enable enhanced logging and real-time alerting for suspicious connection attempts; isolate deployments in separate network zones when possible; consider temporarily disabling non-critical Coherence components until patches become available; conduct network traffic analysis to verify no unauthorized access has occurred.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Coherence
View allRemote takeover of Oracle Coherence (Fusion Middleware) via the Centralized Third Party Jars component allows an unauthe
Remote takeover of Oracle Coherence is possible via HTTP by an unauthenticated network attacker, affecting Oracle Fusion
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core compon
Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reach
Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion
Remote unauthenticated takeover of Oracle Coherence (Oracle Fusion Middleware) is possible over HTTPS, affecting support
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remo
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the netwo
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Co
Exploit-DB