CVE-2026-83413: Oracle Coherence Privilege Escalation Flaw

CVE-2026-83413 Overview

CVE-2026-83413 is an integrity vulnerability in the Oracle Coherence product of Oracle Fusion Middleware, affecting the Core component. Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected. The flaw permits a high-privileged attacker with local logon access to the infrastructure hosting Oracle Coherence to modify a limited subset of Coherence-accessible data. Successful exploitation results in unauthorized update, insert, or delete access to some Coherence data. Oracle addressed the issue in the Oracle Security Alert CSPUSEP2026.

Critical Impact
A high-privileged local attacker can achieve unauthorized modification of a subset of Oracle Coherence data, with no confidentiality or availability impact.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0, 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-09-15 - CVE-2026-83413 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83413

Vulnerability Analysis

CVE-2026-83413 affects the Core component of Oracle Coherence, an in-memory data grid within Oracle Fusion Middleware. The vulnerability enables integrity-only impact: an attacker can perform unauthorized update, insert, or delete operations against a subset of data accessible to Coherence. Confidentiality and availability are not affected. Oracle classifies exploitation as difficult, requiring both local logon access to the host infrastructure and high privileges on that host.

Because exploitation requires local access and existing high privileges, the practical attack surface is narrow. However, in production environments where Coherence caches business-critical state, unauthorized modification of grid data can cascade into downstream application logic errors, corrupted transactional state, or bypass of validation constraints enforced only at the application tier.

Root Cause

Oracle has not published the specific weakness (CWE) or technical root cause for CVE-2026-83413. The advisory indicates the defect resides in the Coherence Core component and requires local infrastructure access, suggesting the affected code path is not exposed over the standard Coherence cluster network protocol to unauthenticated remote callers. Consult the Oracle Security Alert CSPUSEP2026 for vendor-supplied technical details.

Attack Vector

The attack vector is local (AV:L) with high attack complexity (AC:H) and high privilege requirements (PR:H). An attacker must already possess an authenticated shell or equivalent execution context on the server where Oracle Coherence runs. From that position, the attacker interacts with Coherence in a manner that bypasses expected integrity controls, resulting in low-scope write access to grid data. No user interaction is required.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. EPSS scoring places the probability of near-term exploitation in the lowest percentiles.

Detection Methods for CVE-2026-83413

Indicators of Compromise

Unexpected mutation of Coherence cache entries that do not correspond to legitimate application writes or cluster replication events.
Local shell sessions or process executions on Coherence hosts by administrative accounts outside of scheduled change windows.
Anomalous invocations of Coherence management or JMX interfaces from local processes not associated with the Coherence runtime.

Detection Strategies

Enable and forward Oracle Coherence audit and cache event logs to a centralized log platform for correlation with host authentication events.
Baseline legitimate cache-write patterns per service and alert on deviations in write volume, key ranges, or origin process.
Correlate privileged local logons on Coherence hosts with subsequent cache-state changes to identify unauthorized modification chains.

Monitoring Recommendations

Monitor authenticated local sessions and sudo or privilege-elevation events on servers running Coherence.
Track file integrity on Coherence configuration files, override files, and cache persistence directories.
Ingest host and application telemetry into a centralized data lake to enable retroactive hunting once vendor detection guidance becomes available.

How to Mitigate CVE-2026-83413

Immediate Actions Required

Inventory all Oracle Coherence deployments and identify hosts running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
Apply the patches referenced in the Oracle Security Alert CSPUSEP2026 during the next available maintenance window.
Review and reduce the population of accounts with high-privilege local logon rights on Coherence infrastructure.

Patch Information

Oracle released fixes as part of Security Alert CSPUSEP2026. Administrators should download the applicable Coherence patch for their installed version and follow Oracle's standard Fusion Middleware patching procedures. Refer directly to the Oracle Security Alert CSPUSEP2026 for patch identifiers and installation prerequisites.

Workarounds

Restrict interactive and remote administrative access to Coherence hosts to a minimal set of vetted operator accounts.
Enforce host-level segmentation so that only Coherence runtime processes and authorized administrators can interact with Coherence sockets and management endpoints.
Apply strict role-based access control on Coherence management interfaces (JMX, REST) and disable any that are not required for operations.

bash

# Example: restrict local shell access on a Coherence host to a dedicated admin group
sudo groupadd coherence-admins
sudo usermod -aG coherence-admins <approved_admin>
sudo chown root:coherence-admins /opt/oracle/coherence
sudo chmod 750 /opt/oracle/coherence

# Restrict JMX management port to loopback only in coherence-cache-config.xml
# <management-config>
#   <managed-nodes>dynamic</managed-nodes>
#   <allow-remote-management>false</allow-remote-management>
# </management-config>