This vulnerability affects Oracle Coherence, a component of Oracle Fusion Middleware. It is an easily exploitable issue that permits unauthenticated attackers with network access over HTTP to compromise the system, potentially leading to full control over Oracle Coherence. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The affected versions explicitly stated are 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation level for Oracle Coherence. Customers are advised to remain on supported versions and apply patches promptly when released.

Successful exploitation can lead to complete compromise of Oracle Coherence, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected product remotely without authentication, posing a critical risk to affected environments.

Oracle's advisory does not explicitly confirm patch availability for this vulnerability at this time. Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly once available and remaining on actively supported versions. Until a patch is confirmed, restrict network access to Oracle Coherence instances and monitor Oracle advisories for updates.