This vulnerability in Oracle Coherence allows a low privileged attacker with access to the infrastructure and requiring human interaction to compromise Oracle Coherence. The attack scope includes unauthorized creation, deletion, or modification of critical data, with a scope change potentially impacting additional Oracle products. The CVSS vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) indicates local attack vector, high attack complexity, low privileges required, user interaction required, scope change, and high confidentiality and integrity impact without availability impact. Affected versions explicitly include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vendor advisory does not currently specify a remediation level or patch availability but directs users to the July 2026 Critical Patch Update advisory for patch information.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Coherence. The vulnerability affects confidentiality and integrity of data, potentially allowing attackers to compromise critical data or gain complete access to all data accessible by Oracle Coherence. The scope of impact may extend beyond Oracle Coherence to other Oracle products. The vulnerability requires local access with low privileges and user interaction, making exploitation difficult but impactful if successful.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly once available and remaining on actively-supported versions. Until patches are applied, restrict infrastructure access to trusted users and monitor for unusual activity requiring human interaction that could facilitate exploitation.