The vulnerability resides in the Core component of Oracle Coherence and is an Access Control - Authentication flaw (CWE-284). It permits an unauthenticated attacker with network access via TCP to fully compromise the system. Successful exploitation can lead to the attacker taking control of Oracle Coherence, resulting in loss of confidentiality, integrity, and availability of the data and services managed by the framework.

Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected. These releases are part of Oracle Fusion Middleware and are used in environments that require in‑memory data grid services.

CVSS 9.8 indicates critical severity and EPSS < 1% suggests low current exploitation probability, but the vulnerability is still highly dangerous. It is not listed in CISA’s KEV catalog, so no confirmed public exploits yet. The likely attack vector is network‑based TCP access that requires no authentication, making the attack simple to conduct once the vulnerable service is exposed.