This vulnerability affects Oracle Coherence, a component of Oracle Fusion Middleware. It allows an unauthenticated attacker with network access over HTTP to compromise the system without any privileges or user interaction. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The affected versions explicitly stated are 12.2.1.4.0 and 14.1.1.0.0. Oracle's July 2026 Critical Patch Update advisory includes security patches for this vulnerability, urging customers to apply patches promptly to mitigate risk.

An attacker exploiting this vulnerability can gain full control over Oracle Coherence, compromising confidentiality, integrity, and availability of the affected system. This could lead to unauthorized data access, data manipulation, and service disruption. The vulnerability is easily exploitable remotely without authentication, increasing the risk of widespread impact if unpatched.

Oracle has released security patches for this vulnerability as part of the July 2026 Critical Patch Update. Customers should apply the relevant patches for Oracle Coherence versions 12.2.1.4.0 and 14.1.1.0.0 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security updates to prevent exploitation. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified in the advisory.