Executive brief
Oracle Coherence, a widely used data grid solution for scaling applications and managing large volumes of data, contains a critical security vulnerability in its core component. An unauthorized attacker can exploit this flaw over the network to gain full control of the Coherence environment. This could lead to the theft of sensitive business data, disruption of application services, and total compromise of the affected infrastructure.
Technical details
A critical vulnerability exists in the Core component of Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw is categorized as easily exploitable and allows an unauthenticated attacker with network access via TCP to compromise the system. Successful exploitation results in a complete takeover of the Oracle Coherence instance, impacting confidentiality, integrity, and availability. While the specific vulnerability class (e.g., deserialization or injection) is not explicitly named in the advisory, the high CVSS score and 'takeover' description suggest a remote code execution or authentication bypass capability. Users are advised to refer to the Oracle Critical Patch Update for July 2026 for remediation steps.
Affected products
- Oracle Coherence 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
Timeline
- 2026-07-21: advisory: Initial publication by Oracle and NVD