CVE-2026-83413

Local Privilege Data Modification in Oracle Coherence

View on CVE.org
Published Sep 15, 2026 CVSS 3.1 · 1.9 Low EPSS < 1% KEV · Not listed
Description
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Coherence executes to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Coherence accessible data. CVSS 3.1 Base Score 1.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N).

Analysis

AI-generated

Technical impact

A local privilege vulnerability in Oracle Coherence allows an attacker who already has high privileged access to the underlying infrastructure to alter data stored within the Coherence cluster. The flaw does not enable code execution or affect confidentiality; its sole impact is to permit unauthorized updates, insertions, or deletions of data accessible through Coherence.

Affected Systems

Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected.

Risk and Exploitability

The CVSS score of 1.9 reflects a low severity with only integrity impact. The EPSS score of less than 1% indicates a very low likelihood of exploitation observed in the wild. It is not listed in the CISA KEV catalog, and no publicly available exploit was reported. The vulnerability can only be exploited by a user who has already logged on with sufficient privileges to the machine running Coherence, so it is a local attack vector requiring local access and administrative rights.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor’s security patch or upgrade to a non‑affected Oracle Coherence release.
  • Restrict local privileges on all servers hosting Coherence, limiting administrative login to trusted accounts and enforcing least privilege for any user with access to the Coherence environment.
  • Enable comprehensive audit logging for all data modification operations performed by Coherence and review logs regularly to detect any unauthorized insert, update, or delete actions.

Generated by OpenCVE AI on September 22, 2026 at 18:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Local Privilege Data Modification in Oracle Coherence
Type Values Removed Values Added
Title Local Privilege Data Modification in Oracle Coherence
Weaknesses CWE-285
Type Values Removed Values Added
Weaknesses CWE-284
Type Values Removed Values Added
Title Local Privilege Data Modification in Oracle Coherence
Weaknesses CWE-285
Type Values Removed Values Added
Title Low‑Impact Integrity Vulnerability in Oracle Coherence Allowing Unauthorized Data Modification
Weaknesses CWE-284
Type Values Removed Values Added
Title Low‑Impact Integrity Vulnerability in Oracle Coherence Allowing Unauthorized Data Modification
Weaknesses CWE-284
Type Values Removed Values Added
Description Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Coherence executes to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Coherence accessible data. CVSS 3.1 Base Score 1.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N).
First Time appeared Oracle
Oracle coherence
CPEs cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:coherence:14.1.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:coherence:15.1.1.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle coherence
References
Metrics cvssV3_1

{'score': 1.9, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N'}
Earlier changes (3)
Weaknesses

Sources

Status
PUBLISHED
Assigner
oracle
Published
Updated
Sep 22, 2026, 2:11 PM
Reserved
Aug 31, 2026, 3:40 PM

View source JSON

Updated
Sep 22, 2026, 2:11 PM

JSON

Status
Analyzed
Published
Sep 15, 2026, 8:18 PM
Modified
Sep 22, 2026, 7:06 PM

View source JSON

No data.

Updated
Sep 22, 2026, 6:45 PM

JSON