The vulnerability exists in Oracle Coherence’s Centralized Third Party Jars component. An unauthenticated attacker who can reach the Coherence HTTP interface can exploit the weakness and take full control of the application. The exploitation can compromise confidentiality, integrity, and availability, allowing the attacker to execute arbitrary code and potentially disrupt service.

Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected. The product is provided by Oracle Corporation and is part of the Oracle Fusion Middleware stack.

The CVSS score of 9.8 reflects a critical severity with no authentication required (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The EPSS score is less than 1%, indicating a low predicted exploitation probability at the moment, but the vulnerability is publicly known and listed in Oracle’s June 2026 security advisory. The attack vector is inferred to be via direct HTTP requests to the Coherence service, which is reachable over the network and does not require credentials. This means an external attacker could potentially compromise the system without any additional access rights.