This vulnerability affects Oracle Coherence, a component of Oracle Fusion Middleware, in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, delete, and read operations on accessible data within Oracle Coherence. The vulnerability is difficult to exploit and has a CVSS 3.1 score of 5.4 with vector AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N, indicating network attack vector, high attack complexity, no privileges required, no user interaction, scope change, low confidentiality and integrity impact, and no availability impact. The vulnerability may also affect other Oracle products due to scope change. The vendor advisory is part of Oracle's July 2026 Critical Patch Update, which includes many security patches, but no specific patch or remediation for this vulnerability is explicitly mentioned in the advisory content provided.

Successful exploitation can result in unauthorized update, insert, or delete access to some Oracle Coherence accessible data, as well as unauthorized read access to a subset of that data. This could lead to data integrity and confidentiality issues within Oracle Coherence and potentially other impacted Oracle products due to scope change. There is no reported impact on availability. The vulnerability is difficult to exploit and requires network access via HTTP without authentication.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly as part of their Critical Patch Update program. Until a specific patch is confirmed, monitor Oracle's advisories for updates. No vendor advisory states that no action is required or that the issue is already mitigated.