Oracle Coherence EUVD-2026-46692

Exploitation requires TCP network access to a Coherence Core listener - a cluster TCMP member port or an Extend/proxy socket - reachable from the attacker's position; no authentication and no user interaction are needed (PR:N/UI:N). The key limiting factor is Oracle's explicit 'difficult to exploit' rating (AC:H): success depends on conditions the attacker cannot fully control, so it is not a point-and-click default-config compromise despite being unauthenticated. Realistic risk therefore hinges on whether Coherence cluster and proxy ports are exposed beyond a trusted internal network; deployments that firewall these ports to trusted hosts substantially limit exploitability.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1 High) presents a tension worth flagging for prioritization: impact is maximal (full C/I/A takeover, no privileges, no user interaction) but Oracle explicitly labels it 'difficult to exploit' (AC:H), meaning success depends on conditions outside the attacker's control such as timing, specific state, or overcoming a defensive check. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was supplied, so there is no external signal of active or imminent mass exploitation. An SSVC framing would place this as exploitation:none, technical impact:total, automatable:no (AC:H argues against reliable automation). Net: this is a genuine high-severity issue that warrants patching on Oracle's CPU cadence, but the high attack complexity and absence of a known exploit make it a lower immediate-fire priority than an equivalent AC:L or KEV-listed bug - treat as important, not emergency, unless Coherence ports are broadly network-exposed.

An attacker with network reachability to a Coherence cluster port or Extend proxy sends specially crafted TCP traffic to the Core component and, after satisfying the difficult-to-meet conditions implied by AC:H, causes the node to process malicious data and gains control of the Coherence instance (full takeover). No credentials or user interaction are required, but the high complexity means the attack is unlikely to be reliably repeatable. No public proof-of-concept has been identified at time of analysis.