CVE-2026-83412: Oracle Coherence Privilege Escalation Flaw

CVE-2026-83412 Overview

CVE-2026-83412 is a network-exploitable vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw allows a low-privileged attacker with Transmission Control Protocol (TCP) network access to compromise the Coherence data grid. Successful exploitation grants unauthorized read, create, delete, and modify access to all data accessible through Oracle Coherence. Affected supported versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle addressed the issue in the Oracle Security Alert published September 2026.

Critical Impact
An authenticated attacker on the network can read and tamper with the entire Coherence data set, undermining the confidentiality and integrity of cached enterprise data.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-09-15 - CVE-2026-83412 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database
September 2026 - Oracle publishes the Oracle Security Alert September 2026

Technical Details for CVE-2026-83412

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used for distributed caching and stateful data management in Fusion Middleware deployments. The Core component handles cluster membership, data distribution, and remote invocations across grid nodes. This vulnerability lets a low-privileged network-based attacker abuse Coherence services reachable over TCP to reach data managed by the grid.

Oracle classifies the issue as easily exploitable and describes the impact as full read access and unauthorized creation, deletion, or modification of all data accessible through Coherence. Availability is not impacted, but confidentiality and integrity are fully compromised. The Exploit Prediction Scoring System (EPSS) rates the near-term exploitation probability at 0.392%.

Root Cause

Oracle has not publicly disclosed the underlying defect class in the Core component. Historically, comparable Coherence Core issues have involved insecure deserialization and insufficient authorization checks on cluster-facing protocols. Refer to the vendor advisory for authoritative technical details.

Attack Vector

Exploitation requires network reachability to a Coherence TCP listener and a low-privilege set of credentials or cluster access. No user interaction is required, and the attack does not cross a privilege boundary beyond the vulnerable process. Attackers on the same segment as Coherence cluster ports are best positioned to abuse the flaw against production data.

No verified public proof-of-concept code is available. See the Oracle Security Alert September 2026 for vendor guidance.

Detection Methods for CVE-2026-83412

Indicators of Compromise

Unexpected TCP connections to Coherence cluster ports (default Coherence Extend and cluster ports) from hosts outside the documented grid topology.
Unusual NamedCache or InvocationService operations originating from non-application service accounts.
Bulk put, remove, or clear operations against caches that normally see low write volume.

Detection Strategies

Enable Coherence audit logging and forward cluster-member join, invocation, and cache-mutation events to a central analytics platform.
Baseline normal Coherence Extend client identifiers and alert on new or unrecognized clients connecting to grid members.
Correlate authentication events on Fusion Middleware hosts with Coherence cache-write spikes to surface low-privileged accounts performing unexpected data changes.

Monitoring Recommendations

Monitor east-west TCP traffic to Coherence ports and alert on connections from outside the WebLogic or application tier.
Track process-level network telemetry on Coherence JVM hosts to detect unauthorized clients binding to the grid.
Review Fusion Middleware account usage weekly and investigate low-privilege accounts that gain Coherence access.

How to Mitigate CVE-2026-83412

Immediate Actions Required

Apply the Oracle Security Alert September 2026 patches to all Coherence installations running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
Inventory every Coherence cluster, including embedded deployments inside WebLogic, and confirm patch coverage.
Restrict Coherence cluster and Extend TCP ports to the application tier using host firewalls and network segmentation.
Rotate credentials for any service account that has authenticated access to Coherence.

Patch Information

Oracle released fixes as part of the September 2026 Security Alert. Consult the Oracle Security Alert September 2026 for exact patch identifiers and installation instructions for each affected Coherence release train.

Workarounds

Enforce TCP-level access controls so only trusted application hosts can reach Coherence cluster and Extend listeners.
Enable Coherence Secure Sockets Layer (SSL) and identity-token authentication on Extend proxies to limit low-privileged access paths.
Deploy Coherence members inside a dedicated network zone isolated from general user and administrative networks until patching is complete.

bash

# Example: restrict inbound access to Coherence Extend port with iptables
iptables -A INPUT -p tcp --dport 9099 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP