This vulnerability affects the Oracle Coherence product within Oracle Fusion Middleware, specifically versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It allows an unauthenticated attacker with network access via HTTP to cause a hang or frequent crash (complete denial of service) and unauthorized modification (update, insert, delete) of some accessible data. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H, indicating network attack vector, high attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact. No official patch or remediation level is stated in the advisory, and no known exploits in the wild have been reported. The vendor advisory references Oracle's Critical Patch Update for July 2026 but does not explicitly confirm patch availability for this specific vulnerability.

Successful exploitation can lead to a complete denial of service of Oracle Coherence by causing hangs or frequent crashes. Additionally, it can result in unauthorized modification of some accessible data, impacting data integrity and availability. Confidentiality is not affected according to the CVSS vector.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly for supported versions. Until a patch is applied, consider restricting network access to Oracle Coherence HTTP interfaces to trusted sources to reduce exposure.