CVE-2026-83416: Oracle Coherence Partial DOS Vulnerability

CVE-2026-83416 Overview

CVE-2026-83416 is a partial denial of service vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. A low privileged attacker with network access over HTTP can compromise the availability of the Coherence service. Oracle rates the issue as easily exploitable, requiring no user interaction.

Affected supported versions include Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability was disclosed in Oracle Security Alert CSPUSEP2026.

Critical Impact
An authenticated attacker with low privileges can trigger a partial denial of service against Oracle Coherence over the network, degrading availability of dependent Fusion Middleware workloads.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-09-15 - CVE-2026-83416 published to NVD
2026-09-16 - Last updated in NVD database
2026 - Addressed in Oracle Security Alert CSPUSEP2026

Technical Details for CVE-2026-83416

Vulnerability Analysis

The flaw resides in the Core component of Oracle Coherence, the in-memory data grid included with Oracle Fusion Middleware. Coherence provides distributed caching and computation services for clustered Java applications. A defect in request handling allows a low privileged attacker to disrupt normal operation of the Coherence service.

Exploitation produces a partial denial of service rather than full service loss. The confidentiality and integrity of cached data are not affected. However, availability degradation in a caching tier can cascade into application-level slowdowns for services that depend on Coherence for session state, distributed locking, or shared configuration.

Oracle has not published deep technical detail beyond the Critical Patch Update advisory. See the Oracle Security Alert CSPUSEP2026 for vendor guidance.

Root Cause

Oracle attributes the issue to the Core component of Coherence. Oracle has not disclosed a CWE classification or the specific code path involved. The vendor advisory is the authoritative reference for the affected subsystem.

Attack Vector

The attack is remote and delivered over HTTP. The attacker must hold valid low-privilege credentials on the target Coherence deployment. No user interaction is required, and Oracle characterizes exploitation as low complexity.

// No verified proof-of-concept is publicly available for CVE-2026-83416.
// Refer to Oracle Security Alert CSPUSEP2026 for vendor-provided details.

Detection Methods for CVE-2026-83416

Indicators of Compromise

Repeated HTTP requests to Coherence management or REST endpoints from a single authenticated principal preceding service degradation.
Coherence node logs showing thread pool saturation, request timeouts, or unexpected cluster member departures.
Sudden increase in cache request latency or dropped client sessions on applications backed by Coherence.

Detection Strategies

Inventory Oracle Fusion Middleware deployments and identify running Coherence versions matching the affected list.
Baseline normal HTTP request volume to Coherence endpoints and alert on deviation from that baseline.
Correlate Coherence service health events with authenticated user activity to identify a suspect source.

Monitoring Recommendations

Enable verbose logging on Coherence HTTP listeners and forward logs to a centralized analytics platform.
Monitor JVM metrics on Coherence cluster members for abnormal CPU, garbage collection, or thread state changes.
Track authentication events for low-privilege accounts that access Coherence management interfaces.

How to Mitigate CVE-2026-83416

Immediate Actions Required

Apply the Oracle patches referenced in Oracle Security Alert CSPUSEP2026 to all affected Coherence versions.
Restrict network access to Coherence HTTP endpoints to trusted management networks only.
Audit low-privilege accounts that can reach Coherence and remove unnecessary access.

Patch Information

Oracle addresses CVE-2026-83416 in Security Alert CSPUSEP2026, covering Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Consult the Oracle Security Alert CSPUSEP2026 for the specific patch numbers and download instructions applicable to each version.

Workarounds

Place Coherence management interfaces behind a reverse proxy that enforces rate limiting and IP allow-listing.
Enforce strong authentication and least privilege on all Coherence client and management accounts.
Segment Coherence cluster traffic on a dedicated VLAN not reachable from general application user networks.

bash

# Example: restrict Coherence HTTP management port with host firewall (Linux)
# Replace 10.0.0.0/24 with your trusted management subnet and 8080 with your Coherence HTTP port
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP