This vulnerability in Oracle Coherence allows an attacker with low privileges and physical access to the communication segment of the hardware running Oracle Coherence to compromise the system. The attack surface includes versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability has a CVSS 3.1 score of 9.0 with attack vector requiring adjacent network access (AV:A), low attack complexity (AC:L), low privileges (PR:L), no user interaction (UI:N), scope changed (S:C), and high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). The vendor advisory is a general Critical Patch Update that includes many patches but does not explicitly confirm a patch for this specific vulnerability. No known exploits in the wild have been reported.

Successful exploitation can lead to complete takeover of Oracle Coherence, affecting confidentiality, integrity, and availability of the system. The vulnerability may also impact additional Oracle products due to scope change. The attack requires physical access to the communication segment attached to the hardware, which limits remote exploitation but still poses a critical risk in environments where such access is possible.

Oracle has released a Critical Patch Update advisory that includes multiple security patches. However, the advisory does not explicitly confirm patch availability for this specific vulnerability in Oracle Coherence. Customers should consult the Oracle Critical Patch Update July 2026 advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant patches promptly. Until a patch is confirmed and applied, restrict physical access to the communication segments of hardware running Oracle Coherence to mitigate risk.