This vulnerability affects Oracle Coherence, a component of Oracle Fusion Middleware, specifically versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It is an easily exploitable issue that allows unauthenticated attackers with network access via TCP to gain unauthorized access to critical data or all data accessible through Oracle Coherence. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact with no integrity or availability impact. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function). The Oracle Critical Patch Update advisory for July 2026 mentions a large number of security patches but does not explicitly state a patch or fix for this vulnerability, nor does it indicate that the vulnerability is already mitigated or requires no action.

Successful exploitation can lead to unauthorized access to critical or all data accessible via Oracle Coherence without requiring authentication. This compromises confidentiality but does not affect integrity or availability. The vulnerability is exploitable remotely over the network via TCP and does not require any privileges or user interaction, making it a significant risk for affected deployments.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly to address vulnerabilities. Until a patch is confirmed and applied, restrict network access to Oracle Coherence services to trusted hosts only and monitor for unusual access patterns. No vendor advisory states that no action is required or that the issue is already mitigated.