CVE-2026-83415 is a vulnerability in the core component of Oracle Coherence within Oracle Fusion Middleware. It affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw allows a low privileged attacker with network access via HTTP to compromise Oracle Coherence, potentially leading to full takeover of the component. The vulnerability is rated with a CVSS 3.1 score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 patches across multiple products. Customers are urged to apply these patches without delay.

Successful exploitation of this vulnerability can result in complete compromise of Oracle Coherence, impacting confidentiality, integrity, and availability of the affected system. The vulnerability requires network access via HTTP and low privileges but has high attack complexity. There are no known exploits in the wild at this time. The impact is rated high severity with a CVSS score of 7.5.

Oracle has released an official fix for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 promptly to mitigate this risk. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch availability and installation instructions are provided in the Oracle advisory.