CVE-2020-2555

What is Oracle Coherence?

Oracle Coherence is an in-memory distributed data grid — a caching and data-sharing layer used by applications to share state across a cluster of servers without hitting a database for every request. It's bundled into Oracle Fusion Middleware and WebLogic Server, and also embedded inside a range of other Oracle products — Utilities Framework, Retail Assortment Planning, Commerce, and the Communications Diameter Signaling Router among them — often as a transitive dependency administrators may not realize is present, similar to how Log4j turned up unexpectedly deep inside unrelated Java applications.

Overview

CVE-2020-2555 is an unauthenticated remote code execution vulnerability in Oracle Coherence, reachable via its T3 protocol (the same RPC protocol implicated in numerous WebLogic RCEs) or, in some configurations, over HTTP. An attacker who can reach a vulnerable Coherence endpoint can submit a crafted serialized payload that exploits an unsafe deserialization path, achieving code execution without authentication (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical). Because Coherence ships embedded inside several unrelated Oracle product lines, the vulnerability's real-world footprint extends well beyond organizations that knowingly run WebLogic or Fusion Middleware.

Affected Products

Technical Details

Coherence's T3-based clustering and data-sharing protocol deserializes objects exchanged between cluster nodes; when this interface is reachable by an untrusted client — either because it's misconfigured to listen beyond the intended cluster network, or because the hosting product exposes it as part of its normal operation — an attacker can submit a malicious serialized object exploiting a known-unsafe deserialization gadget chain in Coherence's classpath, achieving remote code execution (CWE-502).

Discovery

Patched as part of Oracle's January 2020 Critical Patch Update; security researchers subsequently published proof-of-concept exploit chains demonstrating the deserialization path once the patch was reverse-engineered.

Exploitation Context

This CVE illustrates the same "hidden transitive dependency" risk documented in our landmark CVEs analysis around Log4Shell — organizations running Oracle Retail, Utilities, Commerce, or DSR products may not have realized they were exposed to a WebLogic-adjacent vulnerability class at all, since Coherence isn't the product they explicitly deployed. CISA added the CVE to KEV in November 2021 based on confirmed exploitation.

Remediation

1. Apply Oracle's January 2020 Critical Patch Update across every product in the affected-products table above — not just WebLogic and Fusion Middleware installations, since Coherence ships embedded in several unrelated product lines.
2. Inventory which of your Oracle products bundle Coherence, even if you don't run WebLogic directly — this vulnerability affects Retail, Utilities, Commerce, and Communications DSR customers who may not think of themselves as "WebLogic shops."
3. Restrict T3 protocol access to trusted cluster networks only, blocking it at the firewall from any untrusted network or the general internet.
4. Monitor for unauthorized processes or unexpected outbound connections on any host running an affected product that has had its Coherence/T3 interface reachable from outside the intended cluster network.