CVE-2026-83354: Infoleak
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 15.1.1.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Coherence accessible data. CVSS 3.1 Base Score 6.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N).
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for assessment?
Oracle Coherence version 15.1.1.0.0 is identified as affected. Prioritize instances that are reachable over HTTP from networks accessible to low-privileged users, especially where Coherence can access sensitive data or supports other products.
What access does an attacker need to exploit this issue?
An attacker needs network access via HTTP and low-level privileges. Exploitation is described as difficult and does not require user interaction.
What is the potential impact of successful exploitation?
A successful attack can provide unauthorized access to critical data or complete access to data accessible through Oracle Coherence. Because the vulnerability has scope change, the impact may significantly extend to additional products.