This vulnerability in Oracle Coherence allows an unauthenticated attacker with network access via HTTP to compromise the system, potentially resulting in complete takeover. It affects specific versions of Oracle Coherence (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0). The CVSS 3.1 score of 9.8 reflects critical severity with impacts on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory addresses this vulnerability among others and strongly recommends applying the patches without delay. While the advisory does not explicitly list fixed versions for Oracle Coherence, it emphasizes the importance of staying on supported versions and applying the provided patches. Until patches are applied, risk reduction may be possible by blocking network protocols required for exploitation, though this may impact functionality.

Successful exploitation allows an unauthenticated attacker with network access via HTTP to fully compromise Oracle Coherence, leading to complete takeover of the product. This impacts confidentiality, integrity, and availability of the affected system. The vulnerability is rated critical with a CVSS 3.1 base score of 9.8.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update promptly to address this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation, though this may disrupt application functionality. Removing unnecessary privileges or access to certain packages for users who do not require them may also reduce risk. Customers should remain on actively supported versions and apply security patches without delay. Patch status is not explicitly confirmed for Oracle Coherence versions in the advisory; check the vendor advisory for the latest patch availability and installation instructions.