This vulnerability affects Oracle Coherence, a component of Oracle Fusion Middleware, specifically versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It is exploitable by unauthenticated attackers over HTTP, allowing them to compromise the system and potentially take over Oracle Coherence. The CVSS 3.1 score of 9.8 reflects critical severity with impacts on confidentiality, integrity, and availability. The vulnerability is included in Oracle's July 2026 Critical Patch Update, which addresses 1449 security issues across multiple Oracle products. While the advisory confirms the existence of patches in this update, it does not explicitly state the patch availability for this specific vulnerability, so users must verify patch details in the official documentation.

Successful exploitation can lead to complete compromise of Oracle Coherence, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected Oracle Coherence instances, potentially leading to unauthorized data access, modification, or service disruption.

Oracle has released a Critical Patch Update in July 2026 that includes security patches addressing this vulnerability among others. Users should promptly review the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches to affected Oracle Coherence versions. Patch status is not explicitly confirmed in the advisory excerpt provided; therefore, users must consult the vendor advisory for the latest remediation guidance. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay.