Oracle Coherence EUVD-2026-46685

Exploitation requires possession of a high-privileged Oracle Coherence account (administrator-equivalent), confirmed by the CVE description's explicit 'high privileged attacker' language and the CVSS PR:H metric - this vulnerability is not reachable by unauthenticated or low-privilege users. HTTP network access to the Coherence Core component is required (CVSS AV:N), meaning the Coherence service's HTTP interface must be reachable from the attacker's network position. No user interaction is needed once the privileged session is established (UI:N). Key limiting factors: the PR:H requirement restricts the exploitable population to insiders or attackers who have already achieved administrator-level compromise within the Coherence environment; scope is unchanged (S:U), so this vulnerability does not directly enable lateral movement to systems outside the Coherence cluster boundary; and no specific non-default configuration prerequisite is described, suggesting this affects default-installed Coherence instances accessible over HTTP once administrative credentials are present.

The CVSS 3.1 base score of 5.5 (Medium) accurately reflects the risk profile when the PR:H prerequisite is weighed against the high confidentiality impact. Attack vector is network (AV:N) with low complexity (AC:L), meaning that once an attacker has a qualifying privileged credential, exploitation is mechanically straightforward with no evasion requirements. The confidentiality impact is rated HIGH - meaning complete exposure of all Coherence-accessible data is possible - while integrity impact is LOW (partial modification) and availability is unaffected. The tension between the 'Authentication Bypass' tag and the PR:H vector is notable: these are not inherently contradictory if the bypass operates within the product's internal access-control layer rather than at the network authentication boundary, meaning the attacker is already authenticated but bypasses scope-level authorization. No EPSS score was provided, so probabilistic exploitation likelihood cannot be independently quantified. The absence of KEV listing and public POC suppresses real-world risk from high-CVSS territory to a genuine Medium: this is primarily an insider threat or post-compromise privilege-escalation scenario rather than an opportunistic internet-facing risk. Defenders in environments where Coherence is internet-accessible or accessible by a broad internal user population should elevate their urgency.

A malicious insider or an attacker who has already compromised a high-privileged Oracle Coherence administrator account sends crafted HTTP requests to the Coherence Core service, triggering an internal authorization bypass that exposes cached data sets beyond the account's authorized partition scope - potentially including application secrets, session tokens, or sensitive business records stored in the grid. The low attack complexity (AC:L) means no specialized exploit tooling or timing is required beyond the privileged credential and HTTP reachability. No public POC has been identified at time of analysis, limiting this scenario to targeted actors with existing privileged access.