This vulnerability affects the Oracle Coherence product component of Oracle Fusion Middleware. It is easily exploitable remotely without authentication via TCP network access. Successful exploitation results in the ability to cause a hang or frequent crashes, leading to a complete denial of service condition. The CVSS 3.1 base score is 7.5, reflecting high impact on availability with no impact on confidentiality or integrity. The vulnerability is tracked under CWE-400 (Uncontrolled Resource Consumption). The affected versions explicitly stated are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not provide a direct patch link or specific remediation instructions for Oracle Coherence within the advisory excerpt provided.

An unauthenticated attacker with network access can exploit this vulnerability to cause Oracle Coherence to hang or crash repeatedly, resulting in a denial of service. There is no impact on confidentiality or integrity, but availability is severely affected. This can disrupt services relying on Oracle Coherence, potentially causing operational downtime.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others but does not explicitly confirm patch availability or provide specific remediation instructions for Oracle Coherence in the provided content. Therefore, patch status is not yet confirmed — users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch and remediation guidance. Oracle strongly recommends applying security patches promptly once available and remaining on actively supported versions. Until a patch is confirmed, consider restricting network access to Oracle Coherence TCP ports to trusted sources to reduce exposure.