This vulnerability in Oracle Coherence (component: Core) affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It allows an unauthenticated attacker with network access via TLS to compromise the product, potentially resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 base score is 5.9, reflecting a network attack vector with high attack complexity and no privileges or user interaction required. The impact is limited to confidentiality, with no integrity or availability impact. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information). The vendor advisory does not explicitly confirm patch availability or remediation status for this specific vulnerability but references a Critical Patch Update containing multiple patches. No known exploits have been reported in the wild.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible through Oracle Coherence. The confidentiality of sensitive information is at risk, but there is no impact on data integrity or system availability. The attack requires network access via TLS and is considered difficult to exploit due to high attack complexity.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed, monitor vendor advisories for updates. No vendor advisory states that no action is required or that the vulnerability is already mitigated.