This vulnerability in Oracle Coherence (component: Core) allows an attacker with low privileges and network access via TCP to cause a hang or repeated crash, resulting in a complete denial of service. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates network attack vector, low attack complexity, required privileges as low, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. The affected versions explicitly stated are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vendor advisory from Oracle (July 2026 Critical Patch Update) does not explicitly confirm a patch for this specific vulnerability but strongly urges customers to apply available patches without delay. Patch status is not yet confirmed; users should monitor the vendor advisory for updates.

Successful exploitation results in a denial of service condition by causing Oracle Coherence to hang or crash repeatedly. There is no impact on confidentiality or integrity. The vulnerability can be exploited remotely over the network with low privileges, making it a risk for availability disruption in affected environments.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends that customers remain on actively supported versions and apply security patches promptly when available. Until a patch is confirmed, consider limiting network access to Oracle Coherence services to trusted sources to reduce exposure.