Executive brief
A critical vulnerability has been identified in Oracle Coherence, a data grid solution used for high-speed data processing and application scaling. An unauthenticated attacker can remotely exploit this flaw over the network to gain full control of the affected system. This could lead to the complete theft of sensitive data, unauthorized modification of information, or a total shutdown of the service.
Technical details
A vulnerability exists in the Core component of Oracle Coherence (Fusion Middleware). The flaw is easily exploitable by an unauthenticated attacker with network access via TCP. While the specific vulnerability class (e.g., deserialization or injection) is not explicitly named in the advisory, the impact is a complete compromise of Confidentiality, Integrity, and Availability (CIA triad), effectively allowing a full system takeover. The vulnerability affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Users are advised to refer to the Oracle Critical Patch Update (CPU) for July 2026 for remediation steps.
Affected products
- Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
Timeline
- 2026-07-21: advisory: Published by Oracle and NVD