This vulnerability affects the Oracle Coherence product component of Oracle Fusion Middleware. It is easily exploitable by unauthenticated attackers over the network via TCP, enabling them to cause a hang or frequent crashes leading to a complete denial of service. The CVSS 3.1 base score is 7.5, reflecting a high severity with an impact on availability only (CVSS vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The affected versions explicitly include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle's July 2026 Critical Patch Update advisory references patches addressing this vulnerability among 1449 security fixes across multiple products. No known exploits in the wild have been reported at this time.

Successful exploitation results in unauthorized denial of service by causing Oracle Coherence to hang or crash repeatedly. This disrupts availability of the affected service but does not compromise confidentiality or integrity of data. The vulnerability can be exploited remotely without authentication, increasing its risk profile.

Oracle has released security patches for this vulnerability as part of the July 2026 Critical Patch Update. Users should promptly apply the relevant patches for Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 as detailed in the Oracle advisory (https://www.oracle.com/security-alerts/cpujul2026.html). No alternative mitigations or temporary fixes are indicated. Maintaining up-to-date patched versions is the recommended remediation.