This vulnerability in Oracle Coherence's core component allows an unauthenticated attacker with network access via TCP to exploit the system easily, leading to full compromise of Oracle Coherence. The CVSS 3.1 score of 9.8 reflects critical severity with high impact on confidentiality, integrity, and availability. Affected versions explicitly include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not provide direct confirmation of a patch or mitigation specific to Oracle Coherence in the excerpt provided. No known exploits in the wild have been reported at this time.

Successful exploitation allows an unauthenticated attacker with network access to take over Oracle Coherence, impacting confidentiality, integrity, and availability of the system. This could lead to unauthorized data access, data manipulation, and service disruption.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory content provided does not explicitly confirm the availability of a patch or official fix for Oracle Coherence. Customers are strongly advised to monitor the Oracle Critical Patch Update advisory for patch availability and apply updates promptly once released. Until a patch is confirmed, no specific mitigation steps are detailed by Oracle. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance: https://www.oracle.com/security-alerts/cpujul2026.html