This vulnerability affects Oracle Coherence, a component of Oracle Fusion Middleware, in the specified versions. It allows a high privileged attacker with network access via HTTP to gain unauthorized access to critical data or full access to all data accessible by Oracle Coherence. Additionally, the attacker may perform unauthorized update, insert, or delete operations on some data. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for it. Customers are strongly advised to apply Oracle Critical Patch Updates promptly.

Successful exploitation can result in unauthorized access to critical data or complete access to all Oracle Coherence accessible data. It also allows unauthorized modification (update, insert, delete) of some data. The confidentiality impact is high, integrity impact is low, and availability is not affected. The vulnerability requires a high privileged attacker with network access via HTTP.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm the availability of a specific patch or remediation level for this vulnerability. Customers should review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply all relevant patches without delay. Until a patch is applied, ensure that only trusted, high privileged users have network access to Oracle Coherence services over HTTP to reduce risk.