EUVD-2026-46716
GHSA-jf42-85gf-mpr9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Coherence TCP proxy/cluster port
-
DeliverySend crafted Core-component message
-
ExploitTrigger unhandled hang or crash
-
ExecutionRepeat to sustain outage
-
ImpactComplete denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires TCP network reachability to an Oracle Coherence Core listener - a cluster member port or a Coherence*Extend proxy endpoint - running one of the affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no special conditions, authentication, or user interaction are needed against a reachable node. The primary limiting factor is exposure: Coherence is typically deployed on internal/trusted cluster networks, so realistic risk is confined to deployments where the cluster or Extend proxy ports are exposed to untrusted networks or partners; impact is limited to availability (denial of service) with no data compromise. |
| Impact | The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a genuinely low-barrier attack: network reachable, low complexity, no privileges, no user interaction, with impact limited to availability. That makes the 7.5 score credible for exposed Coherence nodes but the blast radius is availability only - no confidentiality or integrity loss. No EPSS score, KEV entry, POC, or SSVC decision was provided in the input, so exploitation-probability and automatability signals are unknown; the assessment rests on Oracle's own 'easily exploitable' characterization plus the CVSS metrics. This is a real priority for internet- or partner-facing Coherence clusters (or any where the cluster/proxy TCP ports are broadly reachable), but the practical risk drops sharply in typical deployments where Coherence listens only on trusted internal cluster networks. No public exploit identified at time of analysis, so this is not yet weaponized; treat it as a patch-in-normal-cycle availability issue unless the affected nodes are network-exposed. |
| Exploit ScenarioDerived | An attacker who can reach a Coherence cluster or Coherence*Extend proxy TCP port sends a crafted or malformed message to the Core component, causing the targeted node to hang or crash. By repeating the request the attacker keeps the node down, degrading or disabling the cache/data-grid tier that dependent applications rely on. No authentication or user interaction is required, and no public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Denial-of-service in Oracle Coherence (Core component) of Oracle Fusion Middleware lets an unauthenticated attacker with TCP network access hang or repeatedly crash the in-memory data grid, producing a complete availability outage. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0; the CVSS 3.1 base score is 7.5 with a pure availability impact (A:H). Oracle rates it 'easily exploitable,' but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for each affected branch - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0; Oracle distributes these as CPU patches rather than named point releases, so the exact patched build should be taken from the CPU patch matrix for your version (Patch available per vendor advisory). Until patching, restrict network exposure of Coherence cluster and Coherence*Extend proxy TCP ports to trusted hosts only via firewall/security-group ACLs, and place proxy tiers behind network segmentation so untrusted clients cannot reach the listener - the trade-off is that legitimate remote Extend clients must be explicitly allowlisted. Where feasible, enable TCP client authentication/TLS on Coherence*Extend proxies to force authentication before message processing, accepting the configuration and certificate-management overhead. Because impact is a hang/crash, also ensure cluster nodes are supervised (auto-restart) to limit outage duration, though this does not prevent repeated attacks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Coherence is a distributed in-memory data grid and caching platform bundled with Oracle Fusion Middleware, used to cluster application state and share data across JVM nodes over TCP (Coherence*Extend / cluster protocols). The flaw resides in the Core component and is reachable directly over the network via TCP without authentication, consistent with a malformed-request or resource-exhaustion condition in cluster/proxy message handling. Oracle did not assign a CWE (CWE: N/A), but the symptom profile - a hang or frequently repeatable crash triggered remotely with no data exposure (C:N/I:N) - maps to the uncaught-exception / uncontrolled-resource-consumption class (e.g., CWE-400 or CWE-248) rather than a memory-corruption or logic-bypass bug. The single CPE, cpe:2.3:a:oracle_corporation:oracle_coherence, confirms the product scope is Coherence itself rather than a downstream WebLogic or Fusion application.
Know when Oracle Coherence gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated (PR:N), low-complexity TCP-reachable request (AV:N/AC:L) causing a repeatable crash with only availability impact (A:H; C:N/I:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Executive ViewAI
Oracle Coherence (Fusion Middleware component) contains an unauthenticated denial-of-service vulnerability that enables network attackers to crash or hang the in-memory data grid, resulting in complete service outages for dependent applications. Organizations running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 face immediate availability risk, particularly if infrastructure is accessible from untrusted networks. Oracle's assessment that the vulnerability is 'easily exploitable' demands rapid mitigation despite the current absence of public exploit code.
No vendor-released patch identified at time of analysis. Implement network-layer defenses: restrict TCP access to Coherence ports using firewall rules and network segmentation, enforce strict ingress/egress policies, and implement DDoS/connection-throttling mechanisms on network perimeters. Deploy application-level monitoring for service crashes and availability degradation with automated alerting. Maintain offline backups and recovery procedures to enable rapid restoration if exploitation occurs. Establish continuous monitoring of Oracle security advisories and set up automated alerts for patch releases.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Oracle Coherence
View allRemote takeover of Oracle Coherence (Fusion Middleware) via the Centralized Third Party Jars component allows an unauthe
Remote takeover of Oracle Coherence is possible via HTTP by an unauthenticated network attacker, affecting Oracle Fusion
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core compon
Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reach
Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion
Remote unauthenticated takeover of Oracle Coherence (Oracle Fusion Middleware) is possible over HTTPS, affecting support
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remo
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the netwo
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Co
Exploit-DB