The vulnerability resides in the Core component of Oracle Coherence, part of Oracle Fusion Middleware, and allows an unauthenticated attacker with network access via HTTP to execute arbitrary code and seize full control of the installation. Because the scope is changed by the flaw, it can also compromise additional applications that depend on Coherence, resulting in loss of confidentiality, integrity, and availability for the target system.

Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected. These releases are distributed as part of Oracle Fusion Middleware and are listed in the Oracle security advisory released in June 2026.

The CVSS base score is 10 and the EPSS score is less than 1%, indicating a highly exploitable flaw that is easy to use but currently has a low exploitation probability. The attack vector is network‑based over HTTP, requires no authentication or user interaction, and because the vulnerability changes scope the damage can affect an entire Coherence cluster or any integrated applications. The vulnerability is not yet listed in CISA's KEV catalog, but its severity warrants prompt remediation.