This vulnerability in Oracle Coherence's core component allows an attacker with low privileges and network access over HTTP to compromise the product, potentially leading to full takeover. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector with high attack complexity, requiring low privileges and no user interaction, and results in high impact on confidentiality, integrity, and availability. The affected versions explicitly include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which contains numerous fixes across multiple products. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can lead to complete compromise of Oracle Coherence, impacting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected Oracle Coherence instances, potentially leading to unauthorized data access, data manipulation, and service disruption.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these official patches promptly to remediate the vulnerability. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.