This vulnerability affects Oracle Coherence version 15.1.1.0.0 and involves a flaw that can be exploited remotely over HTTP by an attacker with low privileges. Successful exploitation results in unauthorized access to sensitive or all accessible data within Oracle Coherence. The vulnerability has a CVSS 3.1 vector of AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, high attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact. Oracle's advisory for the September 2026 Critical Security Patch Update includes this vulnerability among 673 fixes, emphasizing the importance of applying patches promptly.

The vulnerability allows unauthorized access to critical or all accessible data in Oracle Coherence, potentially compromising confidentiality. There is no impact on integrity or availability. The attack requires network access via HTTP and low privileges, with high attack complexity. The scope of impact may extend to additional products due to the integration of Oracle Coherence.

Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk. Oracle recommends remaining on actively-supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.