A vulnerability in Oracle Coherence allows an unauthenticated attacker with network access to exploit HTTP/2 and take full control of the application. This information exposure flaw (CWE-200) grants full confidentiality, integrity, and availability compromise, effectively allowing a remote takeover of the service.

Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected. These versions are released under Oracle Fusion Middleware and are likely deployed in enterprise settings.

The CVSS base score of 9.8 indicates critical severity, and the low EPSS (<1%) suggests that exploitation attempts are currently rare, but the vulnerability remains present in unpatched systems. The vulnerability is not listed in CISA KEV, however the potential for catastrophic impact warrants urgent attention. Attackers would need only network connectivity to a vulnerable Coherence instance and can exploit it via HTTP/2 without any authentication, leading to full compromise.