CVE-2026-83354: Oracle Coherence Information Disclosure

CVE-2026-83354 Overview

CVE-2026-83354 affects the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw allows a low-privileged attacker with network access over HTTP to compromise confidentiality of data managed by Oracle Coherence. The vulnerability carries a scope change, meaning successful exploitation can impact resources beyond the vulnerable component. Oracle disclosed the issue in the Oracle Security Alert Advisory CSPUSEP2026. Exploitation is rated as difficult, but a successful attack yields unauthorized access to all Oracle Coherence accessible data.

Critical Impact
Successful exploitation results in unauthorized read access to critical or all data accessible to Oracle Coherence, with impact extending across security scope boundaries.

Affected Products

Oracle Coherence 15.1.1.0.0
Oracle Fusion Middleware (Core component)
Deployments exposing Coherence services over HTTP

Discovery Timeline

2026-09-15 - CVE-2026-83354 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83354

Vulnerability Analysis

CVE-2026-83354 is an information disclosure vulnerability within the Core component of Oracle Coherence 15.1.1.0.0. An authenticated attacker with low privileges can send crafted HTTP requests to the Coherence service to retrieve data they are not authorized to view. The vulnerability affects confidentiality only; integrity and availability remain intact. Oracle classifies exploitation as difficult, indicating specialized conditions or timing must be met to achieve compromise.

The scope change property is significant. The vulnerability originates in Oracle Coherence, but exploitation can impact additional products that share the same security authority or data plane. In distributed cache and in-memory data grid deployments, this typically means leakage of application state, session data, or business objects held across cluster members.

Root Cause

Oracle has not published implementation-level details. Based on the CVSS metrics and the scope change indicator, the root cause is an authorization or access control weakness within the Core component that permits a low-privileged HTTP client to reach data belonging to other tenants, applications, or security contexts within the Coherence data grid.

Attack Vector

Exploitation requires network access to the Oracle Coherence HTTP endpoint and valid low-privileged credentials. No user interaction is required. The attacker issues crafted HTTP requests against Coherence management or data APIs to read protected data. Because scope changes, the disclosed data can belong to workloads managed outside the direct security boundary of Coherence itself.

Oracle has not released a public proof-of-concept, and no exploit code is publicly available. Consult the Oracle Security Alert CSPUSEP2026 for authoritative technical details.

Detection Methods for CVE-2026-83354

Indicators of Compromise

Unexpected HTTP requests to Oracle Coherence management or REST endpoints from low-privileged service accounts
Access log entries showing enumeration of cache names, cluster members, or MBean paths outside normal application patterns
HTTP 200 responses to Coherence data-plane requests originating from accounts not associated with application workloads

Detection Strategies

Baseline legitimate HTTP traffic to Coherence endpoints and alert on deviations in request patterns or source identities
Correlate authentication events with subsequent data-access operations to identify anomalous privilege usage
Ingest Coherence and Fusion Middleware access logs into a security data lake for cross-source correlation

Monitoring Recommendations

Enable verbose audit logging on Coherence HTTP listeners and management interfaces
Monitor egress traffic from Coherence hosts for unusual volumes indicating bulk data exfiltration
Track service-account credential usage against expected application call patterns and flag outliers

How to Mitigate CVE-2026-83354

Immediate Actions Required

Inventory Oracle Coherence 15.1.1.0.0 deployments and identify those exposing HTTP endpoints
Restrict network reachability of Coherence HTTP ports to trusted management and application subnets only
Rotate and audit low-privileged service accounts that can authenticate to Coherence
Review Oracle Security Alert CSPUSEP2026 and plan patch deployment

Patch Information

Oracle addressed CVE-2026-83354 in the security update tracked as CSPUSEP2026. Apply the fixes documented in the Oracle Security Alert CSPUSEP2026 to Oracle Coherence 15.1.1.0.0 installations. Oracle recommends applying Critical Patch Updates and Security Alerts as soon as they are released.

Workarounds

Place Coherence HTTP endpoints behind an authenticating reverse proxy that enforces strict allowlists
Disable unused Coherence REST or management interfaces where feasible
Enforce the principle of least privilege on all Coherence roles and remove unnecessary low-privileged accounts
Segment Coherence clusters from general application networks using firewall rules or service mesh policies

bash

# Configuration example: restrict Coherence HTTP listener to management subnet
# In tangosol-coherence-override.xml
<management-config>
  <http-managed-nodes>inherit</http-managed-nodes>
  <access-controller>
    <class-name>com.tangosol.net.security.DefaultController</class-name>
  </access-controller>
</management-config>

# Firewall rule example (iptables) to limit access to Coherence HTTP port
iptables -A INPUT -p tcp --dport 30000 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 30000 -j DROP