This vulnerability in Oracle Coherence's core component allows an unauthenticated attacker with network access via TCP to compromise the system. The affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires no privileges or user interaction and can lead to full confidentiality, integrity, and availability compromise. The vendor advisory references Oracle's July 2026 Critical Patch Update, which includes security patches for Oracle Coherence among many other products. However, the advisory content does not explicitly confirm the availability of a patch specifically for this vulnerability or provide remediation details.

Successful exploitation allows an unauthenticated remote attacker to take over Oracle Coherence, impacting confidentiality, integrity, and availability of the affected system. This could lead to unauthorized data access, data manipulation, and service disruption.

Oracle has released a Critical Patch Update in July 2026 that addresses this vulnerability along with many others. Customers are strongly advised to apply the relevant patches from this update promptly. Since no explicit patch version or temporary workaround is provided in the advisory content, applying the official Critical Patch Update is the recommended remediation. Monitor Oracle's official security advisory for detailed patch availability and installation instructions.