Oracle Coherence
Monthly
Unauthorized data read in Oracle Coherence Core component affects all four supported release lines (12.2.1.4.0 through 15.1.1.0.0) via HTTP, allowing a low-privileged network attacker to access a subset of cached data without proper authorization. The vendor-assigned 'Authentication Bypass' tag suggests the root cause is an authorization control deficiency in the HTTP-facing Core layer rather than a complete absence of authentication - low-privilege credentials appear sufficient to bypass higher-tier access controls. No public exploit or active exploitation has been identified at time of analysis; EPSS data was not provided in the input.
Denial of service in Oracle Coherence's Core component allows a low-privileged network attacker to cause a hang or repeatable crash of the service via TCP, affecting all four currently supported release lines (12.2.1.4.0 through 15.1.1.0.0). Oracle classifies this as easily exploitable - low attack complexity and no user interaction required - making it accessible to any authenticated user with TCP connectivity to the cluster. No public exploit has been identified at time of analysis, and Oracle disclosed this through its July 2026 Critical Patch Update; the CVE is not listed in CISA KEV.
Partial denial of service in Oracle Coherence's Core component allows a low-privileged, network-connected attacker to degrade availability across four supported release lines (12.2.1.4.0 through 15.1.1.0.0) via HTTP with low attack complexity. The CVSS 3.1 vector confirms a straightforward network path requiring only a valid low-privilege account and no user interaction, with impact strictly bounded to partial availability loss - confidentiality and integrity are unaffected. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA's KEV catalog.
Unauthorized read access to Oracle Coherence data is achievable by unauthenticated network attackers targeting the Core component via HTTP across all current supported releases (12.2.1.4.0 through 15.1.1.0.0). The 'Authentication Bypass' tag combined with a PR:N CVSS vector confirms that no credentials are required, but impact is bounded to a partial subset of accessible data (C:L), not full cluster compromise. No public exploit or CISA KEV listing exists at time of analysis, placing this in the medium-priority tier despite the trivially low exploitation complexity.
Unauthorized data access in Oracle Coherence allows a low-privileged, network-adjacent attacker to read, insert, update, or delete data within the Coherence data grid via TCP. Affected versions span the current supported lifecycle: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Despite a moderate CVSS score of 5.4, the 'easily exploitable' descriptor and Authentication Bypass tag suggest the barrier to exploitation is low once an attacker holds any valid low-privileged credential or session token - making this a meaningful data integrity and confidentiality risk in multi-tenant or externally-accessible Coherence deployments. No public exploit code or CISA KEV listing identified at time of analysis.
Oracle Coherence's Core component across all currently-supported Fusion Middleware releases is exploitable by high-privileged network attackers over HTTP to exfiltrate critical in-memory grid data and perform limited unauthorized data modification. Intelligence sources tag this as an authentication bypass class issue, suggesting that a legitimate high-privileged account can circumvent Coherence's internal data-scope access controls to reach data partitions or records beyond its authorized boundary. No public exploit code exists and the vulnerability does not appear in the CISA KEV catalog at time of analysis, placing this in the planned-maintenance remediation tier rather than emergency response.
Unauthenticated confidentiality breach in Oracle Coherence's Core component exposes complete cached data over TLS to network attackers across all current supported versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0). The flaw is tagged as an Authentication Bypass, allowing a remote unauthenticated attacker reachable via TLS to read all data accessible within the Coherence grid - including potentially sensitive application state, session data, and business records. No active exploitation is confirmed (not in CISA KEV) and no public exploit code exists at time of analysis; however, the PR:N/UI:N profile combined with complete confidentiality loss makes this a material concern for enterprises running exposed Coherence clusters.
Oracle Coherence Core in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 exposes a confidentiality flaw that allows a high-privileged local attacker to gain complete unauthorized read access to all data accessible by the Coherence service, with scope change potential extending that breach to additional Oracle Fusion Middleware products sharing the same infrastructure. The CVSS scope change metric (S:C) is the most operationally significant signal here - exploitation is not contained within Oracle Coherence and may expose data in adjacent Oracle products. No public exploit code and no CISA KEV listing exist at time of analysis, and the local attack vector with high-privilege prerequisite significantly constrains real-world exploitability to insider threat or post-compromise scenarios.
Unauthenticated remote read access in Oracle Coherence's Core component allows network attackers to retrieve a subset of data via HTTP without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially exploitable network access with no authentication barrier, consistent with the 'Authentication Bypass' tag applied to this CVE. All four current supported release lines - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - are affected; no public exploit or confirmed active exploitation has been identified at time of analysis.
Denial of service in Oracle Coherence's Core component allows a low-privileged network attacker to crash or indefinitely hang affected instances across four active release branches via crafted TCP communication. The attack requires no user interaction and only low privileges, making it a realistic and automatable threat for any enterprise environment where Coherence cluster ports are reachable by authenticated or low-privileged users. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Oracle's own assessment rates this as network-accessible with low complexity.
Unauthenticated network exploitation of Oracle Coherence's Core component via HTTP allows partial unauthorized read and write access to Coherence-managed data, with a confirmed scope change indicating impact can extend to additional products beyond the directly targeted instance. Affecting four supported versions (12.2.1.4.0 through 15.1.1.0.0), the flaw is tagged as an Authentication Bypass, suggesting the HTTP-facing interface can be accessed without valid credentials under high-complexity attack conditions. No public exploit code has been identified at time of analysis, and Oracle disclosed this through its July 2026 Critical Patch Update.
Unauthorized data read in Oracle Coherence Core enables unauthenticated remote attackers to access a subset of data stored within the in-memory data grid via TCP, with no credentials or user interaction required. Affected versions span the three current release trains: 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, all part of Oracle Fusion Middleware. No public exploit identified at time of analysis; the 'Authentication Bypass' tag combined with a PR:N vector confirms the Core component fails to enforce access controls on inbound TCP connections.
Partial denial-of-service in Oracle Coherence 15.1.1.0.0 (Core component) allows a low-privileged attacker with TCP network access to intermittently degrade availability of the in-memory data grid. The CVSS 3.1 score of 4.3 reflects constrained impact - confidentiality and integrity are unaffected, and no complete service outage is possible. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis; Oracle addressed this vulnerability in the July 2026 Critical Patch Update.
Oracle Coherence (Core component) across all currently supported versions exposes authenticated low-privileged network attackers to unauthorized data access and manipulation over HTTP, enabling both partial read access and unauthorized insert, update, or delete operations on Coherence-accessible cached data. Disclosed as part of Oracle's July 2026 Critical Patch Update, this medium-severity flaw is tagged as an Authentication Bypass, suggesting that a low-privileged credential confers data access beyond its intended authorization scope rather than enforcing proper boundary controls. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis, but the low attack complexity (AC:L) and absence of required user interaction mean exploitation is straightforward for any attacker holding valid Coherence credentials.
Denial-of-service and partial data integrity compromise in Oracle Coherence's Core component allows unauthenticated network attackers to hang or crash the service or manipulate a subset of accessible data via HTTP. Affected are three actively supported versions - 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - spanning the current Oracle Fusion Middleware release train. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the zero-confidentiality-impact, high-availability-impact profile is consistent with a resource exhaustion or malformed-request crash class of flaw that may attract opportunistic targeting of exposed Coherence cluster endpoints.
Unauthorized data read in Oracle Coherence Core component affects all four supported release lines (12.2.1.4.0 through 15.1.1.0.0) via HTTP, allowing a low-privileged network attacker to access a subset of cached data without proper authorization. The vendor-assigned 'Authentication Bypass' tag suggests the root cause is an authorization control deficiency in the HTTP-facing Core layer rather than a complete absence of authentication - low-privilege credentials appear sufficient to bypass higher-tier access controls. No public exploit or active exploitation has been identified at time of analysis; EPSS data was not provided in the input.
Denial of service in Oracle Coherence's Core component allows a low-privileged network attacker to cause a hang or repeatable crash of the service via TCP, affecting all four currently supported release lines (12.2.1.4.0 through 15.1.1.0.0). Oracle classifies this as easily exploitable - low attack complexity and no user interaction required - making it accessible to any authenticated user with TCP connectivity to the cluster. No public exploit has been identified at time of analysis, and Oracle disclosed this through its July 2026 Critical Patch Update; the CVE is not listed in CISA KEV.
Partial denial of service in Oracle Coherence's Core component allows a low-privileged, network-connected attacker to degrade availability across four supported release lines (12.2.1.4.0 through 15.1.1.0.0) via HTTP with low attack complexity. The CVSS 3.1 vector confirms a straightforward network path requiring only a valid low-privilege account and no user interaction, with impact strictly bounded to partial availability loss - confidentiality and integrity are unaffected. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA's KEV catalog.
Unauthorized read access to Oracle Coherence data is achievable by unauthenticated network attackers targeting the Core component via HTTP across all current supported releases (12.2.1.4.0 through 15.1.1.0.0). The 'Authentication Bypass' tag combined with a PR:N CVSS vector confirms that no credentials are required, but impact is bounded to a partial subset of accessible data (C:L), not full cluster compromise. No public exploit or CISA KEV listing exists at time of analysis, placing this in the medium-priority tier despite the trivially low exploitation complexity.
Unauthorized data access in Oracle Coherence allows a low-privileged, network-adjacent attacker to read, insert, update, or delete data within the Coherence data grid via TCP. Affected versions span the current supported lifecycle: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Despite a moderate CVSS score of 5.4, the 'easily exploitable' descriptor and Authentication Bypass tag suggest the barrier to exploitation is low once an attacker holds any valid low-privileged credential or session token - making this a meaningful data integrity and confidentiality risk in multi-tenant or externally-accessible Coherence deployments. No public exploit code or CISA KEV listing identified at time of analysis.
Oracle Coherence's Core component across all currently-supported Fusion Middleware releases is exploitable by high-privileged network attackers over HTTP to exfiltrate critical in-memory grid data and perform limited unauthorized data modification. Intelligence sources tag this as an authentication bypass class issue, suggesting that a legitimate high-privileged account can circumvent Coherence's internal data-scope access controls to reach data partitions or records beyond its authorized boundary. No public exploit code exists and the vulnerability does not appear in the CISA KEV catalog at time of analysis, placing this in the planned-maintenance remediation tier rather than emergency response.
Unauthenticated confidentiality breach in Oracle Coherence's Core component exposes complete cached data over TLS to network attackers across all current supported versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0). The flaw is tagged as an Authentication Bypass, allowing a remote unauthenticated attacker reachable via TLS to read all data accessible within the Coherence grid - including potentially sensitive application state, session data, and business records. No active exploitation is confirmed (not in CISA KEV) and no public exploit code exists at time of analysis; however, the PR:N/UI:N profile combined with complete confidentiality loss makes this a material concern for enterprises running exposed Coherence clusters.
Oracle Coherence Core in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 exposes a confidentiality flaw that allows a high-privileged local attacker to gain complete unauthorized read access to all data accessible by the Coherence service, with scope change potential extending that breach to additional Oracle Fusion Middleware products sharing the same infrastructure. The CVSS scope change metric (S:C) is the most operationally significant signal here - exploitation is not contained within Oracle Coherence and may expose data in adjacent Oracle products. No public exploit code and no CISA KEV listing exist at time of analysis, and the local attack vector with high-privilege prerequisite significantly constrains real-world exploitability to insider threat or post-compromise scenarios.
Unauthenticated remote read access in Oracle Coherence's Core component allows network attackers to retrieve a subset of data via HTTP without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially exploitable network access with no authentication barrier, consistent with the 'Authentication Bypass' tag applied to this CVE. All four current supported release lines - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - are affected; no public exploit or confirmed active exploitation has been identified at time of analysis.
Denial of service in Oracle Coherence's Core component allows a low-privileged network attacker to crash or indefinitely hang affected instances across four active release branches via crafted TCP communication. The attack requires no user interaction and only low privileges, making it a realistic and automatable threat for any enterprise environment where Coherence cluster ports are reachable by authenticated or low-privileged users. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Oracle's own assessment rates this as network-accessible with low complexity.
Unauthenticated network exploitation of Oracle Coherence's Core component via HTTP allows partial unauthorized read and write access to Coherence-managed data, with a confirmed scope change indicating impact can extend to additional products beyond the directly targeted instance. Affecting four supported versions (12.2.1.4.0 through 15.1.1.0.0), the flaw is tagged as an Authentication Bypass, suggesting the HTTP-facing interface can be accessed without valid credentials under high-complexity attack conditions. No public exploit code has been identified at time of analysis, and Oracle disclosed this through its July 2026 Critical Patch Update.
Unauthorized data read in Oracle Coherence Core enables unauthenticated remote attackers to access a subset of data stored within the in-memory data grid via TCP, with no credentials or user interaction required. Affected versions span the three current release trains: 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, all part of Oracle Fusion Middleware. No public exploit identified at time of analysis; the 'Authentication Bypass' tag combined with a PR:N vector confirms the Core component fails to enforce access controls on inbound TCP connections.
Partial denial-of-service in Oracle Coherence 15.1.1.0.0 (Core component) allows a low-privileged attacker with TCP network access to intermittently degrade availability of the in-memory data grid. The CVSS 3.1 score of 4.3 reflects constrained impact - confidentiality and integrity are unaffected, and no complete service outage is possible. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis; Oracle addressed this vulnerability in the July 2026 Critical Patch Update.
Oracle Coherence (Core component) across all currently supported versions exposes authenticated low-privileged network attackers to unauthorized data access and manipulation over HTTP, enabling both partial read access and unauthorized insert, update, or delete operations on Coherence-accessible cached data. Disclosed as part of Oracle's July 2026 Critical Patch Update, this medium-severity flaw is tagged as an Authentication Bypass, suggesting that a low-privileged credential confers data access beyond its intended authorization scope rather than enforcing proper boundary controls. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis, but the low attack complexity (AC:L) and absence of required user interaction mean exploitation is straightforward for any attacker holding valid Coherence credentials.
Denial-of-service and partial data integrity compromise in Oracle Coherence's Core component allows unauthenticated network attackers to hang or crash the service or manipulate a subset of accessible data via HTTP. Affected are three actively supported versions - 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - spanning the current Oracle Fusion Middleware release train. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the zero-confidentiality-impact, high-availability-impact profile is consistent with a resource exhaustion or malformed-request crash class of flaw that may attract opportunistic targeting of exposed Coherence cluster endpoints.