This vulnerability affects Oracle Coherence, a component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.1.0.0. It is an easily exploitable flaw that allows unauthenticated attackers with network access over HTTP to compromise the product, potentially resulting in full takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor advisory is a general Critical Patch Update notice listing many products and versions but does not explicitly confirm patch availability or remediation status for this specific vulnerability. No known exploits in the wild have been reported at this time.

Successful exploitation can lead to complete compromise of Oracle Coherence, impacting confidentiality, integrity, and availability of the system. This means attackers could potentially execute arbitrary code, access sensitive data, or disrupt service availability. The vulnerability is exploitable remotely without authentication, increasing the risk of widespread impact if unmitigated.

Oracle has released a Critical Patch Update advisory covering multiple vulnerabilities including this one. However, the advisory does not explicitly confirm patch availability or remediation status for Oracle Coherence versions 12.2.1.4.0 and 14.1.1.0.0. Customers are strongly advised to review the Oracle Critical Patch Update for July 2026 at https://www.oracle.com/security-alerts/cpujul2026.html and apply any relevant patches promptly. Until official patches or mitigations are confirmed, restrict network access to Oracle Coherence HTTP interfaces to trusted sources only and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.