CVE-2026-83412 in Coherence
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Coherence accessible data as well as unauthorized access to critical data or complete access to all Oracle Coherence accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Core component of Oracle Coherence, a key part of the Oracle Fusion Middleware suite used for distributed data management and caching across enterprise applications. This flaw affects specific supported versions including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The nature of this vulnerability allows for a remote code execution or unauthorized access scenario that is relatively straightforward to exploit due to low complexity requirements. An attacker does not need high-level privileges within the system; instead, a low-privileged user account with network connectivity via TCP can leverage this flaw to gain significant control over the affected Oracle Coherence instances. This characteristic significantly lowers the barrier for entry compared to vulnerabilities requiring administrative access or complex social engineering tactics.
From an operational perspective, the successful exploitation of this vulnerability leads to severe compromises in both data confidentiality and integrity. The attacker gains the ability to create, delete, or modify critical data stored within the Oracle Coherence cache without authorization. This capability extends beyond just sensitive information; it encompasses all accessible data managed by the middleware instance. Consequently, an adversary could alter business-critical records, inject malicious payloads into cached datasets, or erase essential operational data entirely. The impact on availability is noted as negligible in the base score, suggesting that while the system may remain online, its trustworthiness and accuracy are completely undermined. This aligns with CWE-269 Improper Privilege Management, where a user operates beyond their intended permissions, and CWE-352 Cross-Site Request Forgery or similar injection flaws if the vector involves manipulating requests to alter state unexpectedly.
The technical implications of this vulnerability extend deep into the integrity of enterprise applications that rely on Oracle Coherence for session management, real-time analytics, or transaction processing. Since Coherence often serves as a high-performance data grid between application servers and databases, compromising it allows an attacker to bypass database-level security controls by directly manipulating in-memory data structures. This can lead to financial discrepancies, incorrect decision-making based on corrupted metrics, or the persistence of backdoors within the application logic if modified code is cached and served to other users. The vulnerability maps closely to MITRE ATT&CK techniques involving Remote Services exploitation and potentially Data Manipulation for lateral movement or persistent access depending on how the attacker utilizes the altered data state.
Mitigation strategies must prioritize immediate patching to the latest available version of Oracle Coherence that addresses this specific flaw, as relying solely on network segmentation is insufficient given the low privilege requirement for attackers. Organizations should also implement strict input validation and output encoding practices within their applications interacting with Coherence clusters to reduce the attack surface. Additionally, enforcing least-privilege principles across all service accounts accessing the middleware can limit the potential blast radius if a compromise occurs. Network-level controls such as firewalls restricting TCP access to only authorized application servers provide an additional layer of defense but should not be considered a substitute for software remediation. Regular vulnerability scanning and penetration testing focused on middleware components are essential to detect similar misconfigurations or unpatched flaws before they can be exploited in production environments.