Executive brief
Oracle Coherence, a distributed data grid solution used for high-speed data processing and storage, contains a security vulnerability in its Core component. An unauthorized attacker could exploit this flaw over the network to gain access to sensitive business data. If successful, this could lead to a significant breach of confidential information stored within the data grid.
Technical details
A vulnerability exists in the Core component of Oracle Coherence (part of Oracle Fusion Middleware). The flaw is categorized as easily exploitable and allows an unauthenticated attacker with network access via TCP to compromise the system. The primary impact is a loss of confidentiality, where an attacker can gain unauthorized access to critical data or complete access to all data accessible by the Coherence instance. The vulnerability has a CVSS 3.1 base score of 7.5. Users are advised to refer to the Oracle Critical Patch Update for July 2026 for remediation steps.
Affected products
- Oracle Coherence 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
Timeline
- 2026-07-21: advisory: Oracle published the vulnerability details in the July 2026 CPU.
- 2026-07-21: disclosed: NVD published the CVE record.