Executive brief
Oracle Coherence, a data grid solution used for high-speed data processing and application scaling, contains a critical security vulnerability. An unauthorized attacker can exploit this flaw over the network to gain full control of the affected system. This could lead to the complete exposure of sensitive data, unauthorized modification of information, and a total disruption of services.
Technical details
A critical vulnerability exists in the Core component of Oracle Coherence (versions 12.2.1.4.0 and 14.1.1.0.0). The flaw is easily exploitable by an unauthenticated attacker with network access via HTTP. While the specific vulnerability class (e.g., deserialization or injection) is not explicitly named in the advisory, the CVSS vector indicates a remote, low-complexity attack requiring no user interaction. Successful exploitation grants the attacker full control over the Coherence instance, impacting confidentiality, integrity, and availability. Users are advised to refer to the Oracle Critical Patch Update for July 2026 for remediation steps.
Affected products
- Oracle Coherence 12.2.1.4.0, 14.1.1.0.0
Timeline
- 2026-07-21: advisory: Published by Oracle and NVD