Oracle Coherence EUVD-2026-46702

The attacker needs network TCP reachability to a listening Oracle Coherence Core service (a cluster TCMP port or an Extend/proxy listener) on an affected version - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0. Per the CVSS vector AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special product configuration are required beyond the service being network-accessible, so exploitation succeeds against default-reachable deployments. The primary limiting factor is network exposure: environments that segment Coherence cluster/Extend ports behind internal firewalls or restrict them to trusted management subnets sharply reduce the reachable attack surface, and no in-the-wild or POC activity is confirmed from the provided data.

All available signals point to genuine high priority rather than an inflated CVSS. The CVSS vector AV:N/AC:L/PR:N/UI:N gives network reach, low complexity, no privileges, and no user interaction, with S:U and C:H/I:H/A:H yielding 9.8 - Oracle independently characterizes it as 'easily exploitable' resulting in 'takeover,' which aligns with a full RCE-class outcome. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so real-world exploitation frequency cannot be quantified from the input; the absence of KEV means it is not confirmed actively exploited, and the absence of a POC means no public exploit is identified. The main uncertainty is the exact exploitation mechanism and required network exposure: the CVSS implies any network path, but in practice Coherence cluster/Extend ports are often segmented, which may limit reachable targets. Missing CWE and EPSS reduce precision, but the vendor-confirmed unauthenticated takeover on a widely-embedded middleware component justifies treating this as urgent.

An attacker who can reach an exposed Oracle Coherence cluster or Extend proxy TCP port sends a crafted network payload to the Core component and, without any credentials or user interaction, achieves takeover of the Coherence instance - reading and modifying grid data and likely executing code in the middleware process. No public exploit is identified at time of analysis, but Oracle's 'easily exploitable' rating and the 9.8 score indicate a reliable, low-effort attack once a listener is reachable.