CVE-2020-14756: Oracle Coherence RCE Vulnerability

CVE-2020-14756 Overview

CVE-2020-14756 is a critical vulnerability in the Oracle Coherence product of Oracle Fusion Middleware, within the Core Components. An unauthenticated remote attacker can exploit this flaw over the network using the Internet Inter-ORB Protocol (IIOP) or T3 protocols. Successful exploitation results in a full takeover of Oracle Coherence. The vulnerability affects Oracle Coherence versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0, along with several Oracle Utilities Framework releases that bundle the affected component. The EPSS score of 83.392% (99.289 percentile) indicates a high probability of exploitation activity.

Critical Impact

Unauthenticated remote attackers can fully compromise Oracle Coherence over T3/IIOP, leading to complete loss of confidentiality, integrity, and availability of the targeted service.

Affected Products

• Oracle Coherence versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0
• Oracle Utilities Framework versions 4.2.0.2.0, 4.2.0.3.0, 4.4.0.0.0, 4.4.0.2.0, and 4.4.0.3.0
• Oracle Fusion Middleware deployments that embed Oracle Coherence Core Components

Discovery Timeline

• 2021-01-20 - CVE-2020-14756 published to NVD as part of the Oracle Critical Patch Update
• January 2021 - Oracle releases security patch in the Oracle January 2021 Security Alerts
• January 2022 - Additional remediation guidance issued in the Oracle January 2022 Security Alerts
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-14756

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used for caching and distributed computing across Oracle Fusion Middleware deployments. The vulnerability is exploitable over the network without any authentication or user interaction. Attackers reach the cluster through Coherence's remote communication channels, T3 and IIOP, which are exposed for inter-node coordination and client connectivity.

A single network request crafted against an exposed Coherence endpoint can result in full service takeover. Because Coherence frequently runs alongside WebLogic and other middleware tiers, compromise often provides lateral access to backend application data, session caches, and credentials. Oracle classifies this issue under NVD-CWE-noinfo, but it falls within the deserialization defect pattern that has affected Coherence and WebLogic repeatedly.

Root Cause

The defect is rooted in how Coherence Core Components handle untrusted Java objects received over T3 and IIOP. Insufficient validation in the deserialization path allows attacker-controlled gadget chains to execute during object reconstruction. This is the same class of flaw seen in earlier Coherence and WebLogic CVEs that bypassed prior blocklist-based mitigations.

Attack Vector

The attacker requires only network reachability to a Coherence listener port. Many enterprises expose T3 (default 7001) and IIOP listeners to internal networks or, through misconfiguration, to the internet. The attacker sends a malicious serialized payload to the listener. The Coherence JVM deserializes the payload, triggering arbitrary code execution under the privileges of the Coherence process.

No credentials, prompts, or user interaction are needed. The vulnerability is treated by Oracle as a follow-on to CVE-2020-14644 and related issues, where prior fixes did not fully eliminate the deserialization attack surface. See the Oracle January 2021 Security Alerts for technical advisory context.

Detection Methods for CVE-2020-14756

Indicators of Compromise

• Unexpected outbound connections from Coherence or WebLogic JVMs to attacker-controlled hosts following inbound traffic on T3/IIOP listener ports.
• New child processes spawned by java processes running Coherence, such as shells, cmd.exe, powershell.exe, or curl/wget invocations.
• Anomalous serialized object payloads in Coherence logs referencing classes from known deserialization gadget chains (for example, Commons Collections, ROME, or JNDI lookup classes).
• Creation of new files in Coherence working directories or temp paths that are subsequently executed.

Detection Strategies

• Monitor traffic to T3 (7001, 7002) and IIOP ports for binary serialized Java content from untrusted source addresses.
• Alert on Coherence JVMs invoking interactive shells or scripting interpreters, which is anomalous for a data grid process.
• Inspect WebLogic and Coherence access logs for failed or malformed protocol handshakes immediately preceding service errors.

Monitoring Recommendations

• Enable verbose logging for the Coherence cluster service and forward logs to a centralized analytics platform for retention and correlation.
• Track JVM child-process telemetry and network egress on every middleware host running Coherence.
• Correlate listener-port activity with patch state to surface unpatched hosts that received suspicious payloads.

How to Mitigate CVE-2020-14756

Immediate Actions Required

• Apply the Oracle January 2021 Critical Patch Update to every Coherence and Oracle Utilities Framework instance running an affected version.
• Inventory all Coherence deployments, including those embedded within WebLogic domains and Fusion Middleware products, to confirm patch coverage.
• Restrict network exposure of T3 and IIOP listeners so they are reachable only from trusted cluster members and administrative networks.
• Rotate credentials and review cached data on any Coherence instance that was reachable from untrusted networks prior to patching.

Patch Information

Oracle addressed CVE-2020-14756 in the Critical Patch Update released January 2021. Refer to the Oracle January 2021 Security Alerts for the patch matrix and the Oracle January 2022 Security Alerts for follow-up advisories. Patches are distributed through My Oracle Support and must be applied to each affected version listed in the advisory.

Workarounds

• Use WebLogic connection filters to block T3 and IIOP traffic from untrusted source networks where patching cannot be performed immediately.
• Disable the IIOP protocol on Coherence and WebLogic listeners if it is not required by applications.
• Place Coherence cluster traffic on an isolated network segment and require VPN or jump-host access for administrators.
• Deploy a network-layer allowlist at the firewall to restrict Coherence ports to known cluster member IP addresses only.

# Example WebLogic connection filter rule to block T3/IIOP from untrusted networks
# Configure in WebLogic Console: Domain > Security > Filter
# Connection Filter: weblogic.security.net.ConnectionFilterImpl
# Filter Rules (deny all except trusted subnet):
10.10.0.0/16 * * allow t3 t3s iiop iiops
0.0.0.0/0   * * deny  t3 t3s iiop iiops