This vulnerability affects Oracle Coherence, a component of Oracle Fusion Middleware. It is an easily exploitable issue that requires no authentication and can be triggered remotely over HTTP. Successful exploitation can result in full compromise of Oracle Coherence, affecting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and impacts all three security properties at a high level. The affected versions explicitly stated are 12.2.1.4.0 and 14.1.1.0.0. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not provide a direct patch link or specific remediation instructions for this CVE. Customers are urged to apply the Critical Patch Update without delay to mitigate this and other vulnerabilities.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to take over Oracle Coherence. This results in complete compromise of confidentiality, integrity, and availability of the affected system. The critical CVSS score of 9.8 reflects the severe impact and ease of exploitation. No known exploits in the wild have been reported yet, but the potential damage is significant.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. Customers should apply the relevant patches from this update promptly to mitigate the vulnerability. Since no specific patch version is detailed in the advisory content, users must refer to the official Oracle Critical Patch Update documentation at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. No alternative mitigations or workarounds are provided by the vendor advisory.