Executive brief
Oracle Coherence, a data grid solution used for high-speed data processing and storage, contains a critical security vulnerability in its core component. An unauthorized attacker can exploit this flaw over the network to gain full control of the system. This could lead to the theft of sensitive data, disruption of business operations, and total compromise of the affected environment.
Technical details
This vulnerability exists in the Core component of Oracle Coherence (Fusion Middleware). It is classified as easily exploitable, requiring no authentication or user interaction (PR:N/UI:N). An attacker can exploit this flaw by sending malicious TCP traffic to the affected service. Successful exploitation results in a complete loss of confidentiality, integrity, and availability (C:H/I:H/A:H), effectively allowing a full system takeover. The vulnerability affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Users are advised to refer to the Oracle July 2026 Critical Patch Update for remediation steps.
Affected products
- Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
Timeline
- 2026-07-21: advisory: Initial publication by Oracle and NVD