Executive brief
Oracle Coherence, a distributed data grid solution used for high-speed data processing and application scaling, contains a critical security flaw. An unauthenticated attacker can exploit this vulnerability over the network to gain full control of the system. This could lead to the complete exposure of sensitive data, unauthorized modification of information, and disruption of critical business services.
Technical details
A critical vulnerability exists in the Core component of Oracle Coherence (versions 12.2.1.4.0 and 14.1.1.0.0). The flaw is categorized as easily exploitable and allows an unauthenticated attacker with network access via HTTP to compromise the product. While the specific CWE is not detailed in the advisory, the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a remote, low-complexity attack requiring no user interaction or privileges. Successful exploitation allows for a complete takeover of Oracle Coherence, resulting in high impacts to confidentiality, integrity, and availability. Users are advised to refer to the Oracle Critical Patch Update for July 2026 for remediation steps.
Affected products
- Oracle Coherence 12.2.1.4.0, 14.1.1.0.0
Timeline
- 2026-07-21: disclosed
- 2026-07-21: advisory: Oracle July 2026 Critical Patch Update published