This vulnerability in Oracle Coherence, a component of Oracle Fusion Middleware, allows an unauthenticated attacker with network access via TCP to cause a hang or repeated crash, resulting in a complete denial of service. The CVSS 3.1 base score is 7.5, reflecting a high severity with an impact on availability only (CVSS vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The affected versions explicitly stated are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vendor advisory is a general Critical Patch Update for July 2026 covering many products, including Oracle Coherence, but does not specifically confirm patch availability or remediation status for this vulnerability in the extracted content.

Successful exploitation results in an unauthorized ability to cause Oracle Coherence to hang or crash repeatedly, leading to a complete denial of service. There is no impact on confidentiality or integrity. The vulnerability can be exploited remotely without authentication over the network via TCP.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, consider restricting network access to Oracle Coherence services to trusted hosts only to reduce exposure.