CVE-2026-83410
HighCVSS 8.8Summary
Vulnerability in Oracle Coherence (Core component) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. An easily exploitable flaw allows a low-privileged attacker with network access via multiple protocols to compromise Oracle Coherence.
Risk Assessment
A successful attack can result in takeover of Oracle Coherence, impacting confidentiality, integrity and availability. Organizations running these versions face a serious security incident.
Recommendation
Immediately update Oracle Coherence to the version containing Oracle's fix. Restrict network access and monitor for unusual activity.
Other vulnerabilities in Oracle Coherence
See all- CVE-2026-83416Medium
Vulnerability in Oracle Fusion Middleware Oracle Coherence product (component: Core) affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A low privileged attacker with network access via HTTP can cause a partial denial of service (partial DoS) of Oracle Coherence.
- CVE-2026-83415High
Vulnerability in Oracle Coherence (Oracle Fusion Middleware), component Core, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A low-privileged authenticated attacker with HTTP network access can take over Oracle Coherence; the vulnerability is difficult to exploit. CVSS 3.1 Base Score 7.5.
- CVE-2026-83414Low
Vulnerability in Oracle Coherence (component: Core) affecting version 15.1.1.0.0. A difficult-to-exploit flaw allows a low-privileged attacker with local logon to gain unauthorized read access to a subset of Oracle Coherence accessible data.
- CVE-2026-83413Low
Vulnerability in Oracle Coherence (component: Core) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A difficult-to-exploit flaw allows a high-privileged attacker with local logon to gain unauthorized update, insert, or delete access to some Oracle Coherence accessible data.
- CVE-2026-83412High
Vulnerability in Oracle Coherence (Oracle Fusion Middleware), component Core, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A low-privileged authenticated attacker with TCP network access can access data and create, delete, or modify data. CVSS 3.1 Base Score 8.1.
- CVE-2026-83411High
Vulnerability in Oracle Coherence (Core component) affecting versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to compromise Oracle Coherence.
- CVE-2026-83354Medium
Vulnerability in Oracle Fusion Middleware Oracle Coherence product (component: Core) affects version 15.1.1.0.0. A low privileged attacker with network access via HTTP can gain unauthorized access to critical data or complete access to all Oracle Coherence accessible data, and attacks may impact additional products.
- CVE-2026-60308Critical
Vulnerability in Oracle Coherence (Core component) allows an unauthenticated attacker via HTTP to fully compromise the system. The attack is easy to perform.
- CVE-2026-60306Critical
Vulnerability in Oracle Coherence (Core component) allows an unauthenticated attacker via TCP to fully compromise the system. The attack is easy to perform.
- CVE-2026-60302Critical
Vulnerability in Oracle Coherence (Core component) allows an unauthenticated attacker to remotely take over the system via TCP.
Original NVD description (English source)
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).