This vulnerability in Oracle Coherence's core component allows an attacker with low privileges and network access via TCP to compromise the system. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Affected versions explicitly include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vendor advisory references the July 2026 Critical Patch Update, which contains many patches across Oracle products, but does not specifically confirm patch availability or remediation status for this vulnerability. No known exploits in the wild have been reported at this time.

Successful exploitation can lead to complete compromise of Oracle Coherence, impacting confidentiality, integrity, and availability of the affected system. This could allow attackers to take over the Oracle Coherence environment, potentially disrupting services and exposing sensitive data.

The vendor advisory references the July 2026 Critical Patch Update, which typically includes patches for vulnerabilities like this. However, explicit patch availability or remediation instructions for Oracle Coherence are not confirmed in the advisory content provided. Organizations should monitor Oracle's official security alerts and apply relevant patches from the Critical Patch Update as soon as they become available. Until patches are applied, restrict network access to Oracle Coherence instances to trusted sources only to reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.