This vulnerability in Oracle Coherence (Oracle Fusion Middleware component) permits an unauthenticated attacker with network access via TCP to compromise the product. The affected versions explicitly listed are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires no privileges or user interaction and can be executed remotely over the network with low complexity. Successful exploitation can lead to full takeover of Oracle Coherence, impacting confidentiality, integrity, and availability. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function). The vendor advisory from Oracle (July 2026 Critical Patch Update) references this vulnerability but does not explicitly confirm patch availability or remediation status for Oracle Coherence. No known exploits in the wild have been reported as of the advisory date.

An unauthenticated attacker with network access via TCP can exploit this vulnerability to fully compromise Oracle Coherence. This includes complete loss of confidentiality, integrity, and availability of the affected system, effectively allowing an attacker to take over Oracle Coherence instances running the affected versions.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively-supported versions. Until official patches or mitigations are confirmed, restrict network access to Oracle Coherence services to trusted hosts only to reduce exposure.