This vulnerability in Oracle Coherence allows an unauthenticated remote attacker with network access over HTTPS to compromise the product, potentially leading to full system takeover. It affects specific versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 score of 9.8 reflects critical severity with high confidentiality, integrity, and availability impacts. Oracle has acknowledged the issue in its June 2026 Critical Security Patch Update, which includes patches addressing this and many other vulnerabilities. The vendor strongly recommends applying these patches without delay. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce risk temporarily but could disrupt normal operations.

Successful exploitation allows an unauthenticated attacker to fully compromise Oracle Coherence, resulting in complete takeover of the system. This impacts confidentiality, integrity, and availability of the affected product, posing a critical risk to organizations using vulnerable versions.

Oracle has released security patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply these patches promptly to remediate the issue. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation and by removing unnecessary privileges from users. These mitigations may affect application functionality. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory at https://www.oracle.com/security-alerts/cspujun2026.html.