This vulnerability affects the Core component of Oracle Coherence within Oracle Fusion Middleware. It permits a low privileged attacker with network access via TCP to compromise Oracle Coherence, potentially resulting in full product takeover. The CVSS vector indicates network attack vector with high attack complexity, low privileges required, no user interaction, and scope change, with high impacts on confidentiality, integrity, and availability. The affected versions are exactly 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly state the availability of a patch or fix for these specific versions. Customers are strongly advised to review the advisory and apply patches promptly if available.

Successful exploitation can lead to complete compromise of Oracle Coherence, affecting confidentiality, integrity, and availability of the system. Due to scope change, other Oracle products relying on Coherence may also be impacted. The vulnerability is difficult to exploit and requires network access via TCP with low privileges, but the consequences of a successful attack are severe.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. Customers should consult the advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. Since the advisory does not explicitly confirm patch availability for the affected Oracle Coherence versions, patch status is not yet confirmed. Customers should monitor Oracle's official channels for updates and apply any released patches without delay. Maintaining actively supported versions and timely patching is strongly recommended by Oracle to mitigate exploitation risks.