The vulnerability allows an unauthenticated attacker with network access via TCP to fully compromise Oracle Coherence. Successful exploitation results in full control, exposing confidential data, altering integrity, and disrupting availability. The weakness is an improper authentication flaw that permits unauthorized execution of commands within the Coherence environment.

Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are impacted. These products are part of Oracle Fusion Middleware. Users of any of these releases are subject to the risk unless mitigated or updated.

With a CVSS 3.1 score of 9.8 the vulnerability is considered critical. The EPSS score of less than 1% indicates that public exploitation is uncommon at present, and the issue is not listed in the CISA KEV catalog. Nonetheless, the attack vector is straightforward: an attacker only needs to establish a TCP connection to a running Coherence node and can then execute arbitrary commands or gain control of the node without authentication. The system is therefore at high risk of complete compromise if the defect remains unpatched.