This vulnerability affects Oracle Coherence, a component of Oracle Fusion Middleware. It permits an unauthenticated attacker with network access via TCP to read a subset of accessible data without authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and confidentiality impact only. The vulnerability is listed in Oracle's July 2026 Critical Patch Update advisory, which contains numerous patches across Oracle products. However, the advisory does not explicitly confirm the availability of a patch for this specific vulnerability. Oracle advises customers to remain on supported versions and apply patches without delay.

Successful exploitation results in unauthorized read access to some Oracle Coherence data, potentially exposing sensitive information. There is no impact on integrity or availability. The vulnerability is exploitable remotely without authentication, increasing its risk. The CVSS score of 5.3 reflects a medium severity confidentiality impact.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly as part of their Critical Patch Update program. No vendor advisory statement indicates that no action is required or that the vulnerability is already mitigated.