CVE-2020-2555

Oracle Coherence is a system that helps apps share and reuse data quickly (like a high-speed memory “buffer” between services). CVE-2020-2555 is like leaving a public door unlocked: an attacker who can reach the service over the network can take control of it, which can lead to corrupted data and downtime.

This matters if your business runs Oracle Coherence from Oracle Fusion Middleware, including any environment where it’s reachable over the network. The findings indicate no authentication or user interaction is needed for exploitation, and it requires network access via the T3 protocol. Treat it as a risk when your Oracle Coherence service is network-reachable through T3 from an attacker-controlled network path.

This is RED because confirmed real-world exploitation is captured by the CISA KEV listing, and CISA required action by 2022-05-03. Also, publicly available exploits exist, and the vulnerability allows unauthenticated remote takeover—so exposure can become active quickly once reachable.

1. Inventory and exposure check

   • Identify where Oracle Coherence is deployed (all Oracle Fusion Middleware installations that include Coherence).
   • Determine which network interfaces and ports allow inbound access to the Coherence nodes, specifically whether T3 is reachable from untrusted networks.

2. Confirm version status

   • Record the exact Oracle Coherence version on each node.
   • Flag nodes running any of these affected versions for CVE-2020-2555: 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0.

3. Upgrade / patch to Oracle-fixed updates

   • Apply the vendor remediation updates referenced by Oracle in the security alerts for the relevant CPU window(s), using your standard Oracle patching process.
   • After patching, verify the Oracle Coherence version/build level reflects the fixed state as instructed by Oracle’s advisory pages linked in the remediation list.

4. Temporary containment while patching

   • If you cannot immediately patch, reduce exposure by ensuring T3 is not reachable from untrusted networks (for example, restrict inbound access to only trusted administration networks). This matches the exploitation requirement of network access via T3.

5. Validation and monitoring

   • Re-test connectivity restrictions to confirm T3 is not publicly reachable.
   • Review logs for unexpected remote management/invocation activity around the times when exploitation attempts would have been feasible.

6. Compliance timing

   • Note: CISA KEV remediation due date was 2022-05-03; treat any unpatched affected deployments as overdue.

CVE-2020-2555 is a critical Oracle Coherence vulnerability (component: Caching,CacheStore,Invocation) mapped to CWE-502. The findings state it enables takeover of Oracle Coherence and that exploitation does not require authentication or user interaction, but does require network access via the T3 protocol. KEV status is confirmed by CISA (added 2021-11-03) with an official remediation due date of 2022-05-03, indicating it has been observed as being actively exploitable in real environments. Public exploits exist (3 known), increasing practical risk. The attack surface is network-reachable T3 exposure; once reachable, an attacker can trigger the flaw to gain control, leading to integrity and availability impacts (and potential confidentiality exposure via compromise).