Oracle Coherence EUVD-2026-46695

The specific prerequisite is network access to the Oracle Coherence HTTP/2 interface of the Core component on affected versions 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0; per CVSS PR:N/UI:N there is no authentication and no user-interaction requirement. This is effectively unauthenticated remote exploitation against reachable Coherence instances - the primary limiting factor is network exposure of the HTTP/2 listener: environments where that endpoint is confined to an isolated cluster VLAN or firewalled from untrusted networks materially reduce realistic exploitability, whereas any instance exposed to a broader or internet-facing network is directly at risk.

The signals align strongly toward high real-world risk: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) shows network attack vector, low complexity, no privileges, and no user interaction, meaning the raw score of 9.8 is not inflated by unusual preconditions. Oracle explicitly describes it as 'easily exploitable' resulting in 'takeover,' reinforcing the CVSS reading. Countervailing context: it is NOT listed in CISA KEV and no POC is referenced, so this is not confirmed active exploitation - the risk is high potential rather than observed mass exploitation. EPSS and SSVC data were not provided in the input, so automatability and exploitation-status decision inputs cannot be computed here. Net: treat as a priority-one patch for any internet- or partner-network-exposed Coherence instance, while recognizing that at time of analysis exploitation is inferred from CVSS/vendor language, not from a confirmed in-the-wild campaign.

An attacker who can reach a Coherence instance's HTTP/2 endpoint sends a crafted request that exploits the Core component flaw, requiring no credentials and no user interaction. Because impact is full C/I/A takeover, the attacker can read cached application data, tamper with grid state, and gain code-execution-level control of the Coherence process. No public POC is referenced in the available data, so this scenario is derived from the CVSS vector and Oracle's 'takeover' description rather than a demonstrated exploit.