This vulnerability affects the Oracle Coherence component of Oracle Fusion Middleware in versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It is easily exploitable by unauthenticated attackers over TCP network access and can result in complete compromise of Oracle Coherence. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that no privileges or user interaction are required, and the impact on confidentiality, integrity, and availability is high. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function). Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability but does not explicitly state patch availability or remediation level for Oracle Coherence in the provided excerpt.

Successful exploitation can lead to full takeover of Oracle Coherence, impacting confidentiality, integrity, and availability of the affected system. This means attackers could potentially access sensitive data, modify or delete data, and disrupt service operations.

Oracle has published a Critical Patch Update advisory for July 2026 that includes multiple security patches. However, the provided advisory content does not explicitly confirm the availability of a patch or fix for this specific vulnerability in Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant updates promptly. Until a patch is confirmed, monitor Oracle's advisories for updates. No vendor guidance indicates that no action is required or that the issue is already mitigated.