EUVD-2026-46673
GHSA-qm2j-2w85-7323
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Coherence TCP listener over network
-
DeliverySend crafted serialized payload
-
ExploitTrigger unauthenticated flaw in Core component
-
ExecutionAchieve code execution on node
-
ImpactTake over Coherence and access grid data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only TCP network reachability to an Oracle Coherence instance running an affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0); per the AV:N/AC:L/PR:N/UI:N vector there is no authentication, no user interaction and no non-default configuration prerequisite stated by Oracle - no special conditions beyond reaching the Coherence TCP listener against affected versions of Oracle Coherence. The primary limiting factor is network exposure: an attacker must be able to open a TCP connection to the cluster/TCMP or Coherence*Extend proxy port, so instances confined behind firewalls or network segmentation to trusted application tiers are substantially harder to reach. There is no platform-specific or version-specific gate beyond running one of the affected supported versions. |
| Impact | All available severity signals align toward high priority: the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical), meaning no authentication, no user interaction, low complexity and full CIA impact, and Oracle explicitly labels it 'easily exploitable' resulting in complete product takeover. Counterbalancing signals are absent from the input: there is no EPSS score, no KEV listing, and no evidence of public exploit code, so real-world exploitation is currently unproven rather than confirmed. The tag 'Information Disclosure' conflicts with the description's 'takeover' and the I:H/A:H impacts - the CVSS vector is the more authoritative signal and indicates far more than disclosure, so treat the tag as incomplete metadata. Net: this is a genuine critical-severity exposure on any network-reachable Coherence instance, though the likelihood signal (EPSS/KEV) is simply missing rather than low. |
| Exploit ScenarioDerived | An attacker who can reach a Coherence TCP port from the network sends a crafted request or malicious serialized payload to the proxy/cluster listener, requiring no credentials and no user interaction. Because the flaw yields full takeover with low complexity, the attacker gains code-execution-level control over the Coherence node and any data it holds. No public proof-of-concept is identified at time of analysis, but the low-complexity, unauthenticated profile makes weaponization straightforward once details emerge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Remote takeover of Oracle Coherence (Core component of Oracle Fusion Middleware) allows an unauthenticated attacker with TCP network access to fully compromise the affected data-grid instance across versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates it "easily exploitable" with a CVSS 3.1 base score of 9.8 and full confidentiality, integrity and availability impact. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication profile makes it a high-priority patch target.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory) - consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch bundle mapping to your version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0); Oracle publishes the specific fix numbers there and no exact fixed build string is provided in this input to reproduce here. Until the CPU is applied, reduce exposure by restricting network reachability to Coherence TCP listeners (cluster/TCMP and Coherence*Extend proxy ports) to only trusted application tiers via firewall/ACLs or network segmentation, which prevents untrusted clients from reaching the vulnerable transport but requires an accurate inventory of legitimate cluster members and clients to avoid breaking clustering. Where deserialization is the suspected vector, enabling and tightening any available serialization allow-lists/filters (e.g. JDK or Coherence serialization filtering) can raise the exploitation bar, at the cost of testing to ensure legitimate object types are not blocked. Do not expose any Coherence port to the internet.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Coherence is an in-memory distributed data grid used to scale and cache application state, most commonly deployed alongside Oracle WebLogic Server within Fusion Middleware stacks. Cluster and client communication occurs over TCP (Coherence*Extend and the internal cluster/TCMP transport), which is the network surface referenced by the CVSS AV:N/PR:N vector. The advisory does not assign a CWE (listed as N/A) and does not name the exact defect class; however, Oracle's phrasing of an unauthenticated network 'takeover' of a Java middleware component is historically consistent with unsafe deserialization of untrusted objects reaching the grid over its wire protocol - this root cause is inferred, not confirmed by the source data.
Know when Oracle Coherence gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor confirms unauthenticated (PR:N), network TCP (AV:N), easily exploitable (AC:L) takeover with full CIA impact and no scope change, matching a 9.8 base.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Coherence (core data-grid component of Oracle Fusion Middleware) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are vulnerable to unauthenticated remote takeover with CVSS 9.8, enabling complete compromise of system confidentiality, integrity, and availability. Any organization with network-accessible Coherence instances faces immediate risk of data breach and service disruption without authentication barriers protecting the component. Urgent network isolation and access restrictions are required while awaiting vendor remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: implement strict network segmentation isolating Coherence instances to authorized internal systems only via firewall rules; deploy continuous monitoring and alerting on Coherence network traffic and connection attempts; disable or restrict non-essential network exposure of affected Coherence instances; establish daily monitoring of Oracle security advisories for patch availability announcement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Coherence
View allRemote takeover of Oracle Coherence (Fusion Middleware) via the Centralized Third Party Jars component allows an unauthe
Remote takeover of Oracle Coherence is possible via HTTP by an unauthenticated network attacker, affecting Oracle Fusion
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core compon
Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reach
Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion
Remote unauthenticated takeover of Oracle Coherence (Oracle Fusion Middleware) is possible over HTTPS, affecting support
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remo
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the netwo
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Co
Exploit-DB