This vulnerability in Oracle Coherence allows an unauthenticated attacker with network access via TCP to compromise the system, potentially resulting in full takeover. It affects multiple supported versions of Oracle Coherence (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0). The CVSS 3.1 score of 9.8 reflects critical severity with impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory addresses this vulnerability among 1449 security patches. The advisory emphasizes the importance of applying patches without delay to prevent exploitation. No known exploits in the wild have been reported at this time. Patch availability is indicated in the advisory, but specific patch links for Oracle Coherence were not provided in the input data.

Successful exploitation allows an unauthenticated attacker with network access to fully compromise Oracle Coherence, impacting confidentiality, integrity, and availability. This can lead to complete takeover of the affected system. The CVSS 3.1 base score of 9.8 confirms the critical nature of this vulnerability.

Oracle has released security patches for this vulnerability as part of the July 2026 Critical Patch Update. Customers should promptly apply the relevant patches for Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified in the advisory.