This vulnerability affects Oracle Coherence, a component of Oracle Fusion Middleware, specifically versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It is easily exploitable by unauthenticated attackers over HTTP, allowing them to compromise the system and potentially take over Oracle Coherence. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires no privileges or user interaction and can be performed remotely with low complexity, resulting in complete confidentiality, integrity, and availability impact. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). The Oracle July 2026 Critical Patch Update advisory references this vulnerability among many others but does not provide explicit patch details for Oracle Coherence in the excerpt provided.

Successful exploitation can lead to complete compromise of Oracle Coherence, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected Oracle Coherence instances remotely without authentication, posing a critical risk to affected environments.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, no explicit patch availability or remediation level is stated in the provided data. Users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant security updates promptly. Until patches are applied, restricting network access to Oracle Coherence HTTP interfaces and monitoring for unusual activity may reduce exposure.