CVE-2026-83354 in Coherence
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 15.1.1.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Coherence accessible data. CVSS 3.1 Base Score 6.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Core component of Oracle Coherence, a key part of the Oracle Fusion Middleware suite, specifically affecting version 15.1.1.0.0. This flaw represents a significant security risk due to its potential for scope change, meaning that while the technical defect is localized to Oracle Coherence, successful exploitation can lead to compromise of additional products within the broader middleware environment. The vulnerability allows an attacker with low privileges and network access via HTTP to execute unauthorized actions against the system. Although the attack complexity is classified as difficult, requiring specific conditions or inputs to trigger successfully, the availability of a remote vector over HTTP makes it accessible to adversaries who can reach the target service across a network.
From a technical perspective, this vulnerability primarily impacts data confidentiality rather than integrity or availability. The CVSS 3.1 base score of 6.3 reflects medium severity, driven by high confidentiality impact where an attacker gains unauthorized access to critical data stored within Oracle Coherence caches and clusters. Because the privilege requirement is low, any authenticated user with minimal permissions can potentially exploit this flaw if they have network connectivity to the affected service interface. The difficulty in exploitation suggests that while automated tools might not easily detect or trigger this issue without precise crafting of requests, manual exploitation by a determined attacker remains feasible given sufficient time and knowledge of the system's internal state.
The operational impact extends beyond simple data leakage due to the scope change characteristic mentioned in the advisory. Oracle Coherence often serves as an underlying caching layer for various enterprise applications running on top of Fusion Middleware. Compromising this layer can provide attackers with a foothold that allows them to pivot into other connected services or extract sensitive information from multiple integrated systems simultaneously. This lateral movement capability amplifies the risk, turning what might otherwise be an isolated data exposure incident into a broader infrastructure compromise affecting business-critical applications and their associated datasets.
In terms of classification standards, this vulnerability aligns with CWE categories related to improper access control or insufficient authorization checks within network-facing components. It also maps to MITRE ATT&CK techniques involving remote service exploitation where low-privileged accounts are leveraged for initial access followed by data staging or exfiltration through established HTTP channels. The high confidentiality impact indicates that the primary concern is the unauthorized disclosure of proprietary information, customer records, or internal operational metrics stored in memory by Coherence instances.
Mitigation strategies should focus on immediate patching to the latest supported version of Oracle Fusion Middleware and Oracle Coherence as provided by vendor security advisories. In environments where patching cannot be applied immediately, network segmentation is critical; restricting HTTP access to only authorized IP ranges or internal subnets can reduce the attack surface significantly. Additionally, implementing strict firewall rules that limit inbound traffic on ports used by Coherence services will help prevent low-privileged external actors from reaching the vulnerable component. Monitoring for anomalous HTTP requests targeting Coherence endpoints and enforcing strong authentication mechanisms even for low-level users can further mitigate the risk of exploitation until a permanent fix is deployed.