The vulnerability resides in Oracle Coherence's core component. An unauthenticated attacker with network access via TCP can exploit a flaw that permits arbitrary code execution, resulting in full compromise of the Coherence instance. The impact includes loss of confidentiality, integrity and availability as the attacker can take over the service and potentially pivot to other systems.

Affected releases are Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Any deployment of these versions is vulnerable.

The CVSS base score of 9.8 indicates critical severity. The EPSS score is below 1%, suggesting low current exploitation probability, though the flaw is easily exploitable and not listed in the CISA KEV catalog. Attacks would target the Coherence service over TCP without authentication, so any exposed network interface is a potential entry point.