This vulnerability in Oracle Coherence allows an unauthenticated attacker with physical access to the communication segment attached to the hardware running Oracle Coherence to compromise the product. The attacker can gain unauthorized capabilities to create, delete, or modify critical data or all data accessible by Oracle Coherence. The vulnerability affects multiple supported versions of Oracle Coherence: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 vector indicates the attack requires adjacent network access (AV:A), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), and high confidentiality and integrity impacts (C:H/I:H), with no impact on availability (A:N). The vendor advisory is a general Critical Patch Update notice listing many patched products but does not explicitly confirm patch availability or remediation status for this specific vulnerability.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all data accessible by Oracle Coherence. This compromises confidentiality and integrity of the data but does not affect availability. The attacker requires physical access to the communication segment attached to the hardware running Oracle Coherence, which limits the attack vector to adjacent network attackers with physical network access.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Since the vulnerability requires physical access to the communication segment, restricting physical and network access to Oracle Coherence hardware can reduce risk until patches are applied.