This vulnerability affects Oracle Coherence, a component of Oracle Fusion Middleware. It is an easily exploitable network-accessible flaw that requires no authentication and allows an attacker to fully compromise the affected system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that the attack can be performed remotely over the network with low complexity and no privileges or user interaction. Successful exploitation can lead to complete takeover of Oracle Coherence instances running affected versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability among many others but does not explicitly detail patch availability or remediation steps for Oracle Coherence in the excerpt provided.

An unauthenticated attacker with network access via TCP can exploit this vulnerability to gain full control over Oracle Coherence, impacting confidentiality, integrity, and availability. This could allow unauthorized data access, modification, or disruption of services relying on Oracle Coherence.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. Customers are strongly recommended to review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant security patches promptly. Since explicit patch availability for Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 is not confirmed in the provided advisory content, users should verify patch status directly from Oracle's advisory and apply official fixes as soon as they become available. Maintaining actively supported versions and timely patching is critical to mitigate this vulnerability.