This vulnerability in Oracle Coherence, a component of Oracle Fusion Middleware, is easily exploitable by an attacker with low privileges who has network access via TCP. The flaw allows unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Coherence. It affects specific versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 base score is 8.1, indicating high severity with high confidentiality and integrity impacts but no availability impact. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update, which contains 673 security patches across multiple products. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data or full unauthorized access to all data accessible by Oracle Coherence. This compromises confidentiality and integrity of the data but does not affect availability. The vulnerability is exploitable remotely over the network with low attacker privileges, increasing the risk of compromise if unpatched.

Oracle has released an official security patch for this vulnerability as part of its September 2026 Critical Security Patch Update. Customers should apply the provided patches promptly to remediate the vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.