A vulnerability in Oracle Coherence allows an unauthenticated attacker with network access via HTTP to compromise the system, potentially leading to a full takeover. The flaw results in total loss of confidentiality, integrity, and availability, as reflected by the CVSS 3.1 score of 9.8. The short attack vector and lack of required privileges highlight the severity of the weakness, which likely stems from improper access control or authentication checks within the core component.

The affected products are Oracle Corporation’s Oracle Coherence across versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Administrators of these installations should verify which version is in use and plan for remediation.

The high CVSS score indicates a critical risk, though the EPSS score of less than 1% suggests that exploitation has not been widely observed yet. The vulnerability is not listed in CISA’s KEV catalog, but the potential for remote takeover remains significant. Attackers would need only an unauthenticated HTTP connection to attempt exploitation, underscoring the importance of patching or implementing network restrictions.