Oracle Coherence EUVD-2026-46710

Exploitation requires network TCP reach to the Oracle Coherence Core (cluster TCMP or Coherence*Extend proxy) AND a pre-existing low-level privilege (PR:L) - the attacker is not fully unauthenticated, and per the CVSS vector some legitimate low-privileged access or cluster/Extend position is needed. Exploitation is explicitly rated difficult (AC:H), so it depends on specific timing, state, or configuration rather than a single reliable request, which materially limits opportunistic attacks. No user interaction is required (UI:N). Affected only on Coherence 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0; the exact nature of the required privilege is not detailed in the advisory and should be confirmed with Oracle.

The signals are mixed. CVSS is high at 8.5, driven by full C/I/A impact plus the scope change, but two metrics temper urgency: AC:H (Oracle explicitly calls it difficult to exploit) and PR:L (the attacker must already hold some low-level privilege on the Coherence tier). It is network-reachable (AV:N) with no user interaction (UI:N). No EPSS score was provided, there is no POC, and it is absent from CISA KEV, so there is no evidence of active or automatable exploitation - this reads as a serious scheduled-patch priority rather than a drop-everything emergency. The scope change is the main aggravating factor, since successful exploitation can pivot into other Fusion Middleware products, so blast radius may exceed a single Coherence instance. Note the description says 'low privileged attacker' but does not specify what that privilege is (cluster membership, a valid Extend client, or an authenticated app account); verify the exact prerequisite with Oracle before down-ranking.

An attacker who already holds a low-privilege foothold on the Coherence tier - such as a valid Coherence*Extend client or a reachable cluster node - sends specially crafted traffic to the Core component over TCP. Despite the high complexity of getting the conditions right, a successful attack yields full takeover of Coherence and, via the scope change, can compromise other co-located Fusion Middleware products. No public POC is currently available.