This vulnerability in Oracle Coherence's core component allows an attacker with low privileges and logon access to the hosting infrastructure to compromise Oracle Coherence, potentially resulting in complete takeover of the product. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires local access with low complexity and privileges but no user interaction, and impacts confidentiality, integrity, and availability at a high level. Affected versions explicitly include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability is listed in Oracle's July 2026 Critical Patch Update advisory, which contains numerous patches across Oracle products, but no direct patch link or explicit remediation for this specific vulnerability was provided in the input data.

Successful exploitation allows a low privileged attacker who has logon access to the infrastructure running Oracle Coherence to fully compromise the product. This can lead to complete takeover, affecting confidentiality, integrity, and availability of Oracle Coherence services. The high CVSS score reflects the severity of potential impact on affected systems.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, no explicit patch or remediation instructions for Oracle Coherence were provided in the advisory content available. Users should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is applied, restrict access to the infrastructure hosting Oracle Coherence to trusted users only, as exploitation requires logon access. Monitor Oracle's advisories for updates on patch releases and remediation guidance.