This vulnerability in Oracle Coherence, a component of Oracle Fusion Middleware, allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Coherence, as well as unauthorized modification of some data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality impact and low integrity impact, and no availability impact. The affected versions explicitly stated are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vendor advisory from Oracle (July 2026 Critical Patch Update) references this vulnerability but does not provide explicit patch or remediation details for Oracle Coherence in the excerpt provided.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data or full data accessible by Oracle Coherence. Additionally, the attacker can perform unauthorized update, insert, or delete operations on some data. This compromises confidentiality and integrity of the data managed by Oracle Coherence. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the provided advisory content does not explicitly confirm the availability of a patch for Oracle Coherence. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is applied, restrict network access to Oracle Coherence instances to trusted sources only and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.