This vulnerability in Oracle Coherence's core component allows an unauthenticated attacker with network access via TCP to exploit the system easily. Successful exploitation can lead to full compromise of Oracle Coherence, impacting confidentiality, integrity, and availability. The affected versions explicitly listed are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle’s July 2026 Critical Patch Update advisory mentions a large number of patches but does not specifically confirm a patch or fix for this vulnerability in the provided excerpt. No known exploits in the wild have been reported at this time.

An unauthenticated attacker with network access via TCP can exploit this vulnerability to take over Oracle Coherence. This results in complete compromise affecting confidentiality, integrity, and availability of the affected system. The critical severity and high CVSS score reflect the potential for severe damage if exploited.

Oracle’s July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for Oracle Coherence in the provided content. Therefore, patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying all relevant security patches promptly once available and remaining on actively supported versions. Until a patch is confirmed, restrict network access to Oracle Coherence instances to trusted sources only.