CVE-2026-83412 is a high-severity vulnerability in Oracle Coherence (part of Oracle Fusion Middleware Core) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It allows a low privileged attacker with network access via TCP to compromise Oracle Coherence, potentially resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. Oracle has included fixes for this vulnerability in their September 2026 Critical Security Patch Update, which contains 673 security patches across multiple products.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Coherence, or unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of data but does not affect availability. The vulnerability is exploitable remotely over the network with low complexity and requires only low privileges, increasing the risk of compromise if unpatched.

Oracle has released security patches addressing this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or 'no action required' statements are provided by Oracle.