This vulnerability affects Oracle Coherence, a component of Oracle Fusion Middleware. It is easily exploitable by unauthenticated attackers over the network via TCP, enabling compromise and potential takeover of the Oracle Coherence service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that no privileges or user interaction are required, and the impact is high across confidentiality, integrity, and availability. The affected versions explicitly stated are 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vendor advisory is a general Critical Patch Update notice listing many products and versions but does not specifically confirm a patch for Oracle Coherence or these versions at this time.

Successful exploitation allows an unauthenticated attacker with network access to fully compromise Oracle Coherence, leading to complete loss of confidentiality, integrity, and availability of the affected system. This can result in takeover of Oracle Coherence, which may impact dependent applications and services relying on it.

The vendor advisory references a Critical Patch Update containing numerous security patches but does not explicitly confirm a patch for Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0. Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying available security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Coherence instances to trusted sources only.