This vulnerability in Oracle Coherence (Oracle Fusion Middleware component) allows an unauthenticated attacker with network access over HTTP to compromise the system. The affected versions are 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 score of 9.8 reflects critical severity with high impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function). Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm the availability of a patch or fix for these specific versions. Customers are strongly advised to apply Oracle's Critical Patch Update promptly to mitigate this and other vulnerabilities.

Successful exploitation allows an unauthenticated attacker with network access via HTTP to fully compromise Oracle Coherence, resulting in complete takeover. This impacts confidentiality, integrity, and availability of the affected system, posing a critical risk to enterprise environments relying on Oracle Coherence.

Oracle has released a Critical Patch Update in July 2026 that addresses this vulnerability among others. Customers should review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches without delay. Patch status for Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 is not explicitly confirmed in the advisory content provided; therefore, customers must verify patch availability and installation instructions from Oracle's official resources. Remaining on actively supported versions and timely patching is strongly recommended.