This vulnerability in Oracle Coherence allows an unauthenticated attacker who has access to the physical communication segment of the hardware where Oracle Coherence runs to compromise the product. The vulnerability affects multiple supported versions including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 base score is 8.8, indicating high severity with high impact on confidentiality, integrity, and availability. No official patch or remediation level is currently stated in the vendor advisory, but Oracle's July 2026 Critical Patch Update advisory references security patches for multiple products and strongly recommends applying patches promptly. There is no indication of known exploits in the wild at this time.

Successful exploitation of this vulnerability can result in complete takeover of Oracle Coherence, affecting confidentiality, integrity, and availability of the system. An attacker does not require authentication but must have access to the physical communication segment attached to the hardware running Oracle Coherence. This could allow unauthorized control and manipulation of Oracle Coherence operations.

The vendor advisory does not explicitly state that a patch is available for this specific vulnerability, nor does it provide a remediation level. However, it is part of Oracle's July 2026 Critical Patch Update advisory, which includes numerous security patches. Oracle strongly recommends that customers remain on actively supported versions and apply security patches without delay. Users of affected Oracle Coherence versions should monitor the referenced Oracle advisory for patch availability and apply updates promptly once released. Until a patch is applied, restrict physical access to the communication segments and hardware running Oracle Coherence to trusted personnel only.