The vulnerability resides in a Centralized Third Party Jars component of Oracle Coherence, allowing an unauthenticated attacker with network access via HTTP to gain unauthorized access to Coherence data and to perform unauthorized update, insert, or delete operations. This leads to significant confidentiality and integrity compromise by revealing all accessible data and permitting manipulation of that data.

Oracle Coherence version 15.1.1.0.0 is impacted; because the vulnerability can change scope, additional products in Oracle Fusion Middleware may also be affected.

The CVSS v3.1 base score of 9.3 indicates a high severity with confidentiality impact and moderate integrity impact; the EPSS score is below 1%, suggesting low current exploitation probability, and the issue is not listed in CISA KEV. However, the attack vector is a network-facing HTTP endpoint that requires no authentication, making the threat significant for organizations that expose Coherence services to the network.