Coherence

Vendor:

First CVE: Jan 15, 2020 · Active for 6 years

23
Total CVEs
More Total CVEs than 95% of tracked products
5.8
Avg CVEs / Year
Higher CVE frequency than 90% of tracked products
8.4
Avg CVSS
Higher Avg CVSS than 74% of tracked products
4.3%
KEV Rate
Higher KEV Rate than 97% of tracked products

Trends Over Time

The number and severity of CVEs published that impact Coherence over time

Volume of CVEsAvg CVSS Base Score
First CVE
Jan 15, 2020
6 years ago
Most Recent CVE
Jun 16, 2026
38 days ago

CVE Severity & Scoring

Coherence23 CVEs
All CVEs352,294 CVEs
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network23 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low21 (91.3%)
High2 (8.7%)
Unknown0 (0.0%)
User Interaction
None22 (95.7%)
Unknown0 (0.0%)
Required1 (4.3%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None23 (100.0%)
Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (23 CVEs).

23 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2020-2555CRITICAL
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0,
Jan 15, 20209.898YESYES
CVE-2020-14756CRITICAL
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core Components). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12
Jan 20, 20219.865NONO
CVE-2026-35307CRITICAL
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.
Jun 16, 202610.035NONO
CVE-2026-35308CRITICAL
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.
Jun 16, 202610.034NONO
CVE-2026-35306CRITICAL
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). The supported version that is affected is 15.1.1.0.0. Easily
Jun 16, 20269.334NONO
CVE-2026-35310CRITICAL
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.
Jun 16, 20269.833NONO
CVE-2026-35309CRITICAL
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.
Jun 16, 20269.833NONO
CVE-2026-35304CRITICAL
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.
Jun 16, 20269.833NONO
CVE-2020-25649HIGH
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The hi
Dec 3, 20207.533NONO
CVE-2026-35305CRITICAL
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). The supported version that is affected is 15.1.1.0.0. Easily
Jun 16, 20269.332NONO
View all 23 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (23 CVEs).

CISA KEV
1 CVE
4.3% of CVEs· 97th percentile
Metasploit
1 CVE
4.3% of CVEs· 96th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
4.3% of CVEs· 88th percentile

Social Chatter

Signals from CVEs in this product scope (23 CVEs).

Media Mentions

Signals from CVEs in this product scope (23 CVEs).

Top CNAs Publishing CVEs For Coherence

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
3.7.1.098.020.1%11
15.1.1.0.079.70.4%00
14.1.2.0.059.90.5%00
14.1.1.0.0188.36.8%00
12.2.1.4.0208.310.9%11
12.2.1.3.0118.216.7%11
12.1.3.0.098.120.2%11