This vulnerability in Oracle Coherence's core component allows an unauthenticated attacker with network access over HTTP to compromise the product. The affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates the attack requires no privileges or user interaction and can be executed remotely with low complexity, resulting in complete confidentiality, integrity, and availability loss. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not provide explicit patch details or remediation instructions for it. Customers are urged to apply Oracle's cumulative security patches promptly to mitigate this and other vulnerabilities.

Successful exploitation can lead to full compromise of Oracle Coherence, including unauthorized access, data disclosure, data modification, and service disruption. The vulnerability allows an attacker to take over the affected system without authentication, posing a critical risk to confidentiality, integrity, and availability of the service.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm patch availability or provide specific remediation instructions for this vulnerability alone. Customers should review the July 2026 Critical Patch Update documentation and apply all relevant patches promptly to mitigate this and other vulnerabilities. Until patches are applied, restrict network access to Oracle Coherence instances where possible to reduce exposure. Monitor Oracle's official security alerts for updates on patch availability and remediation guidance.