This vulnerability in Oracle Coherence's core component allows an unauthenticated attacker with network access via TCP to exploit the system easily. Successful exploitation can result in complete compromise of Oracle Coherence, including full control over the affected system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that no privileges or user interaction are required, and the attack can be performed remotely with low complexity. Affected versions explicitly include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vendor advisory from Oracle (July 2026 Critical Patch Update) lists this vulnerability among many others but does not explicitly confirm patch availability or remediation status for this specific CVE at the time of publication.

An attacker can remotely exploit this vulnerability without authentication, leading to full compromise of Oracle Coherence. This includes unauthorized disclosure of information, modification or destruction of data, and disruption of service availability. The critical CVSS score (9.8) reflects the severity of these impacts.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until an official patch is confirmed and applied, restrict network access to Oracle Coherence instances to trusted sources only.