This vulnerability affects Oracle Coherence, a component of Oracle Fusion Middleware, in specified versions. It is easily exploitable by an unauthenticated attacker with network access via TCP. Successful exploitation can cause a complete denial of service by hanging or crashing Oracle Coherence and unauthorized modification of some accessible data (update, insert, delete). The CVSS 3.1 vector indicates no confidentiality impact but low attack complexity, no privileges required, no user interaction, and impacts on integrity and availability. The vendor advisory is a general Critical Patch Update notice listing many products and versions but does not explicitly state patch availability or fixes for Oracle Coherence for this issue. No known exploits in the wild have been reported.

An attacker can cause Oracle Coherence to hang or crash repeatedly, resulting in a complete denial of service. Additionally, the attacker can perform unauthorized data modifications including updates, inserts, or deletions on some data accessible through Oracle Coherence. There is no confidentiality impact reported. The vulnerability affects system integrity and availability significantly.

The vendor advisory references a Critical Patch Update containing numerous security patches but does not explicitly confirm a patch or fix for this specific vulnerability in Oracle Coherence. Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly once available and remaining on actively supported versions. Until a patch is confirmed, restrict network access to Oracle Coherence TCP services to trusted sources to reduce exposure.