CVE-2026-83411

Analyzed Analyzed - Analysis Complete

Oracle Coherence Remote Code Execution

Publication date: 2026-09-15

Last updated on: 2026-09-21

Assigner: Oracle

Description

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-21

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-05

NVD

CVE-2026-83411

EUVD

EUVD-2026-79712

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	coherence	12.2.1.4.0
oracle	coherence	14.1.1.0.0
oracle	coherence	14.1.2.0.0
oracle	coherence	15.1.1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Coherence, a middleware product. It allows a low-privileged attacker with network access via HTTP to take over the system. The impact includes confidentiality, integrity, and availability breaches.

Impact Analysis

An attacker could exploit this to gain full control over Oracle Coherence, potentially leading to data theft, unauthorized modifications, or system downtime.

Compliance Impact

This vulnerability allows low-privileged attackers to compromise Oracle Coherence via HTTP, potentially leading to full system takeover. Such unauthorized access could result in unauthorized data access, modification, or deletion, which may violate GDPR (data protection) and HIPAA (health data confidentiality) compliance requirements.

Mitigation Strategies

Apply the latest security patches from Oracle for affected versions of Oracle Coherence (14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0). Restrict network access to HTTP ports used by Oracle Coherence. Monitor for unusual activity in Oracle Coherence processes.

Hi! I’m here to help you understand CVE-2026-83411. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70