This vulnerability in Oracle Coherence's core component permits an unauthenticated attacker with TCP network access to exploit the flaw easily and compromise the system. The affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires no privileges or user interaction and can result in full confidentiality, integrity, and availability compromise. Oracle’s July 2026 Critical Patch Update advisory mentions multiple patches across products but does not explicitly confirm a patch or fix for this specific vulnerability in Oracle Coherence. No known exploits in the wild have been reported at this time.

Successful exploitation allows an unauthenticated remote attacker to fully compromise Oracle Coherence, resulting in complete loss of confidentiality, integrity, and availability of the affected system. This can lead to total takeover of Oracle Coherence environments running the affected versions.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly to address vulnerabilities. Until a patch is confirmed and applied, restrict network access to Oracle Coherence services to trusted hosts only and monitor for suspicious activity.