This vulnerability in Oracle Coherence's core component allows an unauthenticated attacker with network access via HTTP to compromise the system. The affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires no privileges or user interaction and can be executed remotely with low complexity, resulting in complete confidentiality, integrity, and availability compromise. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function). Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for Oracle Coherence in the provided excerpt.

Successful exploitation can lead to full takeover of Oracle Coherence, impacting confidentiality, integrity, and availability of the system. This means attackers could potentially access sensitive data, modify or delete data, and disrupt service operations. The vulnerability is remotely exploitable without authentication, increasing the risk of widespread impact if exposed to untrusted networks.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory content provided does not explicitly confirm the availability of a patch or official remediation for Oracle Coherence. Customers should monitor the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply updates promptly once released. Until a patch is confirmed and applied, restricting network access to Oracle Coherence instances and implementing network-level controls to limit HTTP access may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.