Oracle Coherence EUVD-2026-46676

Exploitation requires the attacker to have access to the physical/adjacent communication segment attached to the hardware where Oracle Coherence executes (CVSS AV:A) - i.e., presence on the same LAN/VLAN or cluster network as a Coherence node, not remote internet reachability. Given that position, no further prerequisites exist: no authentication (PR:N), no user interaction (UI:N), and low attack complexity (AC:L) against the affected supported versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0). The primary limiting factor is therefore network adjacency - a well-segmented, firewalled cluster network that prevents untrusted hosts from reaching Coherence TCMP/Extend traffic substantially reduces exploitability; conversely, flat internal networks make the condition trivial to meet.

The signals are moderately strong but bounded by the attack vector. CVSS 8.8 is high, driven by no authentication (PR:N), no user interaction (UI:N), low complexity (AC:L), and full C/I/A impact - Oracle explicitly calls it 'easily exploitable.' The single most important tempering factor is AV:A (Adjacent): the attacker must already have access to the network/communication segment where Coherence cluster traffic flows, not the open internet, so this is not remotely internet-exploitable. There is no EPSS score, no POC, and no KEV listing in the provided data, so there is no evidence of active exploitation or automated weaponization at this time; no SSVC decision data was provided. Net: a genuine high-severity issue that should be patched promptly on any host running affected Coherence versions, but the real-world blast radius depends heavily on how well the cluster communication segment is network-isolated. Because Coherence clusters are frequently deployed on trusted internal or backend segments, the AV:A restriction is often satisfied by a foothold in the same subnet rather than being a hard barrier.

An attacker who has gained a foothold on the same VLAN as a Coherence cluster - for example via a compromised adjacent application server - sends crafted Coherence cluster protocol traffic to a member node. Because no authentication or user interaction is required and complexity is low, the malicious message is processed and results in takeover of the Coherence instance, exposing cached data and allowing full control. No public POC is identified at time of analysis, so exploitation would currently require attacker-developed tooling.