This vulnerability affects Oracle Coherence, a component of Oracle Fusion Middleware. It permits an unauthenticated attacker with network access via HTTP to read a subset of accessible data without authorization. The CVSS 3.1 base score is 5.3, reflecting a confidentiality impact with no integrity or availability impact. The affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability is categorized under CWE-200 (Exposure of Sensitive Information). Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others but does not provide a direct patch link or explicit remediation details for this specific issue. Oracle strongly recommends applying available patches promptly. No known exploits have been reported in the wild.

Successful exploitation allows unauthorized read access to a subset of data accessible via Oracle Coherence, impacting confidentiality. There is no impact on data integrity or system availability. The vulnerability is exploitable remotely without authentication and requires only network access via HTTP.

Oracle includes this vulnerability in its July 2026 Critical Patch Update advisory. While no explicit patch link for this specific vulnerability is provided, Oracle recommends applying the July 2026 Critical Patch Update promptly to remediate this and other vulnerabilities. Customers should ensure they are running actively supported versions and apply security patches without delay. Patch status is not explicitly confirmed for this vulnerability alone; check Oracle's advisory for the latest remediation guidance.