Oracle Coherence, part of Oracle Fusion Middleware, contains a flaw (CWE‑306) that permits an unauthenticated attacker with network access via HTTP/2 to compromise the service. The vulnerability is easily exploitable and can result in full takeover of the Coherence instance, potentially leading to loss of confidentiality, integrity, and availability for data and applications relying on that instance. The likely impact, based on the wording of the announcement, includes loss of confidentiality, integrity and availability.

Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected. Any deployment that exposes these versions to the network on HTTP/2 is vulnerable.

With a CVSS base score of 9.8, the vulnerability is classified as critical. The EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is unauthenticated network access via HTTP/2, requiring only that the attacker can send crafted HTTP/2 frames to the Coherence service. Successful exploitation would allow an attacker to fully control the Coherence instance, and depending on the environment, further compromise could be possible. The weakness is a missing authentication check (CWE-306).