This vulnerability affects Oracle Coherence, a component of Oracle Fusion Middleware, specifically versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It is exploitable remotely without authentication via HTTP/2, allowing an attacker to compromise the system fully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects an easily exploitable network vulnerability with high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not provide explicit patch details for these versions in the excerpt. The advisory strongly recommends applying security patches promptly for supported versions. No confirmed exploit activity is reported.

Successful exploitation can lead to complete compromise of Oracle Coherence, affecting confidentiality, integrity, and availability of the system. An unauthenticated attacker with network access via HTTP/2 can take over the affected product, potentially leading to unauthorized data access, modification, or service disruption.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly for supported versions to address this and other vulnerabilities. However, the provided advisory content does not explicitly confirm patch availability or an official fix for the affected Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch status and installation instructions. Until patches are applied, restricting network access to Oracle Coherence instances and monitoring for unusual HTTP/2 traffic may reduce exposure.