CVE-2026-83414
LowCVSS 2.5Summary
Vulnerability in Oracle Coherence (component: Core) affecting version 15.1.1.0.0. A difficult-to-exploit flaw allows a low-privileged attacker with local logon to gain unauthorized read access to a subset of Oracle Coherence accessible data.
Risk Assessment
A low-privileged attacker with local access could gain unauthorized access to sensitive data, potentially breaching confidentiality.
Recommendation
Upgrade Oracle Coherence to a version newer than 15.1.1.0.0 as per Oracle guidance.
Other vulnerabilities in Oracle Coherence
See all- CVE-2026-83416Medium
Vulnerability in Oracle Fusion Middleware Oracle Coherence product (component: Core) affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A low privileged attacker with network access via HTTP can cause a partial denial of service (partial DoS) of Oracle Coherence.
- CVE-2026-83415High
Vulnerability in Oracle Coherence (Oracle Fusion Middleware), component Core, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A low-privileged authenticated attacker with HTTP network access can take over Oracle Coherence; the vulnerability is difficult to exploit. CVSS 3.1 Base Score 7.5.
- CVE-2026-83413Low
Vulnerability in Oracle Coherence (component: Core) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A difficult-to-exploit flaw allows a high-privileged attacker with local logon to gain unauthorized update, insert, or delete access to some Oracle Coherence accessible data.
- CVE-2026-83412High
Vulnerability in Oracle Coherence (Oracle Fusion Middleware), component Core, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A low-privileged authenticated attacker with TCP network access can access data and create, delete, or modify data. CVSS 3.1 Base Score 8.1.
- CVE-2026-83411High
Vulnerability in Oracle Coherence (Core component) affecting versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to compromise Oracle Coherence.
- CVE-2026-83410High
Vulnerability in Oracle Coherence (Core component) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. An easily exploitable flaw allows a low-privileged attacker with network access via multiple protocols to compromise Oracle Coherence.
- CVE-2026-83354Medium
Vulnerability in Oracle Fusion Middleware Oracle Coherence product (component: Core) affects version 15.1.1.0.0. A low privileged attacker with network access via HTTP can gain unauthorized access to critical data or complete access to all Oracle Coherence accessible data, and attacks may impact additional products.
- CVE-2026-60308Critical
Vulnerability in Oracle Coherence (Core component) allows an unauthenticated attacker via HTTP to fully compromise the system. The attack is easy to perform.
- CVE-2026-60306Critical
Vulnerability in Oracle Coherence (Core component) allows an unauthenticated attacker via TCP to fully compromise the system. The attack is easy to perform.
- CVE-2026-60302Critical
Vulnerability in Oracle Coherence (Core component) allows an unauthenticated attacker to remotely take over the system via TCP.
Original NVD description (English source)
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 15.1.1.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Coherence executes to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Coherence accessible data. CVSS 3.1 Base Score 2.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).