CVE-2022-21420

published 2022-04-19

CVE-2022-21420: Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0…

Priority P2 61 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected

6 ranges

Vendor	Product	Version range	Fixed in
oracle	coherence	—	—
oracle	coherence	—	—
oracle	coherence	—	—
oracle_corporation	coherence	—	—
oracle_corporation	coherence	—	—
oracle_corporation	coherence	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → CVE-2022-21420 is exploitable over the T3 protocol (Oracle proprietary RMI transport); monitor and restrict T3/T3S traffic to Oracle Coherence cluster ports (default 7001, 7002) from untrusted networks ↗
• → The vulnerability allows full takeover (RCE) of Oracle Coherence without authentication or user interaction; treat any unexpected process spawning from Coherence JVM processes as a high-fidelity indicator of exploitation ↗
• → Affected versions are 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0; inventory and prioritize patching of these specific Oracle Coherence builds ↗

• · The attack vector is Network with no privileges required and no user interaction (AC:L/PR:N/UI:N), meaning the exploit is fully remote and unauthenticated over T3; network-level blocking of T3 access from untrusted sources is a critical compensating control ↗
• · The vulnerable component is the Oracle Coherence Core; no sub-component or specific Java class is named in public advisories, limiting precision of code-level detection rules without further PoC analysis ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

vendor_oracle 9.8 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.