This vulnerability in Oracle Coherence (component: Centralized Third Party Jars) allows an unauthenticated attacker with network access via HTTP to compromise the product fully, resulting in takeover. The vulnerability affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) indicates it is remotely exploitable without authentication, with critical impact on confidentiality, integrity, and availability, and a scope change affecting additional products. Oracle’s June 2026 Critical Security Patch Update includes patches for this vulnerability. No explicit patch or remediation level is stated in the CVE data, but Oracle strongly recommends applying the CSPU without delay.

Successful exploitation allows complete takeover of Oracle Coherence, impacting confidentiality, integrity, and availability of the affected system. Due to scope change, other Oracle products relying on Coherence may also be significantly impacted. The vulnerability is remotely exploitable without authentication, making it highly critical.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability among 245 others. Customers are strongly advised to apply this patch immediately. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or removing unnecessary privileges, though these may impact functionality. Oracle’s advisory emphasizes prompt patching as the primary mitigation.