CVE-2020-14756: Oracle Coherence Core Components unauthenticated remote takeover

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction required and a very high EPSS percentile makes this a top remediation priority despite no KEV listing.

What it is

Oracle Coherence Core Components contains an easily exploitable flaw reachable over IIOP and T3 that lets an unauthenticated network attacker compromise the product. Oracle rates it CVSS 3.1 9.8, and the affected supported versions are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. The record does not describe the underlying weakness beyond NVD-CWE-noinfo, so the exact root cause is not stated.

Impact

Successful exploitation results in takeover of Oracle Coherence, with high confidentiality, integrity and availability impact. The attacker gains control of the affected component rather than a limited read or denial of service.

Attack surface

Reached over the network via IIOP and T3; the CVSS vector shows no privileges required and no user interaction. Any host exposing those Coherence interfaces to untrusted networks is in scope.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is 0.74753 (99.478th percentile), indicating high predicted exploitation activity. References are patch and vendor advisory only, with no public exploit tag supplied.

What to do

• Apply the Oracle January 2021 Critical Patch Update for Coherence, and the January 2022 update where it applies to your version.
• Restrict network access to IIOP and T3 ports so only trusted hosts and management networks can reach Coherence.
• Disable or block IIOP and T3 where they are not required by the deployment.
• Inventory Coherence instances and confirm which of the listed versions are still running, then upgrade or isolate those that cannot be patched.
• Monitor vendor advisories for updated guidance since the record does not detail the root cause.

Detection

• Alert on unexpected inbound connections to Coherence IIOP and T3 ports from untrusted sources.
• Baseline normal Coherence peer traffic and flag new or anomalous remote endpoints.
• Watch for post-exploitation behavior on Coherence hosts such as new processes, outbound connections or configuration changes.
• Correlate Coherence service logs with network flow data for signs of unauthenticated remote interaction.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.