Privilege-escalating takeover of Oracle TimesTen In-Memory Database 26.1.1.1.0 is possible through its Kubernetes Operator component, where a low-privileged attacker with network access over HTTPS can fully compromise the database. Because the flaw carries a scope change, successful exploitation can significantly impact additional products beyond TimesTen itself, and its 9.9 CVSS score reflects complete confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, but the low attack complexity and minimal privilege requirement make it a high-priority patch item.
Full system takeover in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-authenticated attacker to compromise the platform via the WebLogic T3/IIOP protocols. The flaw carries a CVSS 3.1 score of 9.9 with a scope change, meaning successful exploitation impacts additional downstream products beyond the vulnerable component. Addressed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation and data compromise in Oracle Unified Directory 14.1.2.1.0 (OUD Core) lets a low-privileged, authenticated attacker with LDAP network access read, create, modify or delete all OUD-accessible data and cause a partial denial of service. Oracle rates it CVSS 9.9 with a scope change, meaning exploitation can significantly impact additional products beyond the directory itself. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low attack complexity make it a top patching priority.
Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eProcurement component) allows a remote, unauthenticated attacker to reach the module over HTTP and achieve high-impact modification of critical data, limited data disclosure, and a partial denial of service. Because Oracle assigns a scope change (S:C), a successful attack can reach beyond the vulnerable module and significantly impact additional PeopleSoft products, which drives the 9.9 CVSS score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
OS command injection in Tenable Security Center (Tenable.sc) lets an authenticated attacker execute arbitrary shell commands by uploading an audit file whose filename contains shell metacharacters, which the application passes unsanitized into a system command. The flaw (CWE-78) carries a CVSS 4.0 base score of 9.4 with high impact to confidentiality, integrity, and availability of both the vulnerable and subsequent systems. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution risk in Apache Fory (the Java serialization framework formerly known as Fury) before 1.4.0 arises because attacker-supplied data can bypass the class-registration allowlist during Java lambda deserialization, with the gap confined to the lambda capture class. Registration checks are Fory's core defense against untrusted-deserialization gadget attacks, so bypassing them for lambda payloads can let an attacker instantiate otherwise-disallowed classes and reach code execution or memory corruption. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV; the vendor (Apache) rates it CVSS 9.8 and a fixed release (1.4.0) is available.
Remote code execution in Oracle WebLogic Server (Oracle Fusion Middleware Core component) allows an unauthenticated attacker with network access via the SOAP protocol to fully compromise and take over the server. Affected releases are the actively supported 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions, and the flaw carries a critical CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but WebLogic RCE flaws of this class are historically weaponized rapidly.
Complete takeover of Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 is possible by remote, unauthenticated attackers sending crafted HTTP traffic to the Core component, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact) reflects trivially exploitable, network-facing compromise with no authentication or user interaction. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but WebLogic's history as a high-value RCE target makes this a top-priority patch.
Complete takeover of Oracle WebLogic Server is possible by unauthenticated remote attackers via HTTP against the Core component, affecting supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 9.8 (full confidentiality, integrity and availability impact), the flaw requires no privileges, no user interaction and low attack complexity. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but WebLogic's history as a mass-exploited middleware target makes rapid weaponization likely once details emerge.
Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, allowing a remote unauthenticated attacker with only TCP network access to fully compromise the server. The maximum-severity CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) reflects that successful exploitation yields complete confidentiality, integrity, and availability compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but WebLogic's history as a mass-exploited target makes this a high-priority patch.
Remote takeover of Oracle WebLogic Server (Fusion Middleware, Core component) lets an unauthenticated network attacker fully compromise the server by sending crafted requests over the T3 or IIOP protocols. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact and calls it 'easily exploitable,' affecting supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit is identified at time of analysis and it is not in CISA KEV, but this class of unauthenticated T3/IIOP takeover has historically been rapidly weaponized in WebLogic.
Complete server takeover in Oracle WebLogic Server (Fusion Middleware Core component) lets an unauthenticated remote attacker fully compromise affected instances by sending crafted traffic over the T3 or IIOP protocols. It carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable.' Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected; no public exploit identified at time of analysis and it is not currently listed in CISA KEV.
Remote takeover of Oracle WebLogic Server (Fusion Middleware Core component) allows an unauthenticated network attacker to fully compromise the server via a crafted SOAP request. Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected, and Oracle rates it easily exploitable with complete confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit was identified at time of analysis, but given WebLogic's history as a mass-exploitation target, this warrants immediate patching from the July 2026 Critical Patch Update.
Complete server takeover in Oracle WebLogic Server (Fusion Middleware, Core component) is possible by unauthenticated attackers who reach the T3 or IIOP remoting protocols over the network. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning any exposed T3/IIOP listener on affected 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 builds can be commandeered without credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the T3/IIOP attack surface has a long history of weaponized deserialization exploits, so patch urgency is high.
Full compromise of Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Integration component) is possible by an unauthenticated remote attacker over HTTP, with Oracle rating the flaw CVSS 9.8 and describing 'takeover' of the affected module. Disclosed in Oracle's July 2026 Critical Patch Update (CPUJUL2026), the issue affects the Brazilian financial-localization objects of the PeopleSoft Financials suite. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Identity Manager is possible through its OIM Legacy UI component, allowing a remote unauthenticated attacker with only HTTP network access to fully compromise the confidentiality, integrity, and availability of the identity governance platform. Affected releases are the Fusion Middleware bundles 12.2.1.4.0 and 14.1.2.1.0. Oracle rates this CVSS 9.8 and addressed it in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Complete takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 is possible when a remote, unauthenticated attacker reaches the Reporting component over HTTP, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (C:H/I:H/A:H) reflects that a successful attack yields full confidentiality, integrity, and availability compromise of the product. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication, low-complexity profile makes it a high patch priority.
Complete takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 is possible by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw resides in the product's Installation component and yields full compromise of confidentiality, integrity, and availability (CVSS 3.1 9.8). No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Full compromise of Oracle Agile PLM 9.3.6 (Security component) allows an unauthenticated remote attacker to take over the application over HTTP with no user interaction. Rated CVSS 9.8 with high impact to confidentiality, integrity, and availability, this flaw is disclosed via Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-privilege attack profile makes it a high-priority patch for internet- or intranet-exposed instances.
Complete takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via the Endeca Application Controller, which an unauthenticated attacker can reach over HTTP to fully compromise the product. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and is described by Oracle as easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV, but its network-facing, no-authentication profile makes it a high-priority patch item.
Remote takeover in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Content Acquisition System component) allows an unauthenticated attacker with HTTP network access to fully compromise the product. Oracle rates it CVSS 3.1 9.8 with full confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning no authentication or user interaction is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-facing, unauthenticated 'takeover' profile makes it a top-tier patching priority.
Remote takeover in Oracle WebCenter Sites 14.1.2.0.0 allows an unauthenticated attacker with only HTTP network access to fully compromise the product, yielding complete confidentiality, integrity, and availability loss (CVSS 3.1 9.8). Disclosed in the Oracle Critical Patch Update of July 2026 and reported by Oracle's own security alert team, it is rated easily exploitable but has no public exploit identified at time of analysis. WebCenter Sites is Oracle's enterprise web experience/content management platform, so a compromise means attacker control over the delivery of managed web content.
Remote takeover of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated attacker with HTTP network access to fully compromise the product, yielding high confidentiality, integrity, and availability impact per the CVSS:3.1 9.8 (Critical) rating. Oracle describes the flaw as easily exploitable, though it publishes no technical root-cause detail beyond the CPU advisory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated network reach and complete system takeover makes this a top-tier patch priority.
Full system takeover of Oracle Commerce Platform 11.4.0 is possible when a remote, unauthenticated attacker reaches the ATG Portals component over HTTP. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, the flaw is described by Oracle as easily exploitable and yields complete compromise of the platform. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Complete takeover of Oracle WebCenter Enterprise Capture is possible by remote unauthenticated attackers reaching the Client Bundle component over HTTP, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as easily exploitable. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the trivial exploitability and network-facing nature make it a high-priority patch.
Full compromise of Oracle Access Manager is possible when an unauthenticated attacker sends crafted HTTP requests to the Authentication Engine component of affected Oracle Fusion Middleware deployments (12.2.1.4.0 and 14.1.2.1.0). The flaw is rated CVSS 9.8 and, per Oracle, is 'easily exploitable,' resulting in complete takeover of the identity/access layer. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, no-authentication profile makes it a high-priority patch for any Oracle SSO estate.
Remote takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows an unauthenticated attacker with only HTTP network access to fully compromise the platform, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity, and availability and is described by Oracle as easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, low-complexity network profile makes it a top-priority patching item.
Remote takeover of Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows an unauthenticated attacker with only HTTP network access to fully compromise the product, resulting in complete confidentiality, integrity, and availability loss (CVSS 3.1 9.8). Oracle rates the flaw 'easily exploitable' and disclosed it in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Complete takeover of Oracle SOA Suite is possible when an unauthenticated remote attacker sends crafted HTTP traffic to the Enterprise Scheduling System component in versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 base score of 9.8 reflects full loss of confidentiality, integrity, and availability with no privileges or user interaction required. This was disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis, but the trivial exploitation profile makes it a high-priority patch target.
Full system takeover of Oracle SOA Suite (Oracle Fusion Middleware) is possible via the Enterprise Scheduling System component, where an unauthenticated remote attacker can compromise affected 12.2.1.4.0 and 14.1.2.0.0 deployments over HTTP. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) with high confidentiality, integrity, and availability impact, reflecting a network-facing, no-privilege, no-interaction attack. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS and KEV data were not provided in the input.
Full takeover of Oracle Identity Manager Connector (Oracle Fusion Middleware, PeopleSoft Applications component) is possible in supported versions 12.2.1.4.0 and 14.1.2.1.0, where a remote unauthenticated attacker reaching the connector over HTTP can compromise it end to end. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. At the time of analysis there is no public exploit identified and it is not listed in CISA KEV, but the low attack complexity and lack of any authentication make it a high-priority patching target.
Complete takeover of the Oracle Identity Manager Connector (PeopleSoft Applications component of Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP, with CVSS 9.8 reflecting full confidentiality, integrity, and availability loss. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, and the fix ships in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and 'takeover' outcome make it a top-tier patch priority for any environment running this connector.
Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is possible by an unauthenticated remote attacker over the T3 or IIOP protocols, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) the attack is network-reachable, low-complexity, and requires no authentication or user interaction, yielding full confidentiality, integrity, and availability compromise (9.8 Critical). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated pre-auth nature over exposed WebLogic protocols makes this a high-priority patch.
Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is achievable by remote unauthenticated attackers over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting supported versions 12.2.1.4.0 and 14.1.2.0.0, the flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network reach make it a high-priority patching item.
Complete takeover of Oracle Service Delivery Platform (part of Oracle Fusion Middleware) is possible via its Messaging Enabler component, affecting versions 12.2.1.4.0 and 14.1.2.0.0. A remote, unauthenticated attacker reaching the T3 or IIOP protocol ports can fully compromise the platform (full confidentiality, integrity, and availability loss, CVSS 9.8). This was fixed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Communications Service Delivery Platform (SDP) 12.2.1.4.0 and 14.1.2.0.0, shipped within Oracle Fusion Middleware, is achievable by a remote unauthenticated attacker reaching the T3 or IIOP protocols exposed by the underlying WebLogic Server (Messaging Enabler component). Rated CVSS 3.1 9.8 with full confidentiality, integrity and availability impact, this was disclosed in the Oracle July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 allows an unauthenticated remote attacker to take over the platform via crafted HTTP requests. Oracle rates this 9.8 (CVSS 3.1) with full confidentiality, integrity, and availability impact, disclosed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Communications/Fusion Middleware Service Delivery Platform (versions 12.2.1.4.0 and 14.1.2.0.0, Messaging Enabler component) is possible by an unauthenticated remote attacker reaching the T3 or IIOP protocol. The flaw scores CVSS 3.1 9.8 with full confidentiality, integrity, and availability impact and requires no user interaction; no public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the T3/IIOP attack surface historically maps to WebLogic-style deserialization abuse. It was self-reported by Oracle and disclosed in the July 2026 Critical Patch Update.
Complete takeover of Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 is possible by an unauthenticated remote attacker reaching the server over the T3 or IIOP protocols. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact), placing it among Oracle's most severe July 2026 Critical Patch Update fixes. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the T3/IIOP attack surface has a long history of trivially weaponized deserialization exploits.
Complete takeover of Oracle Unified Directory (OUD Core) is achievable by an unauthenticated, network-based attacker communicating over LDAP against supported versions 12.2.1.4.0 and 14.1.2.1.0. Rated CVSS 3.1 9.8 with full confidentiality, integrity, and availability impact and marked 'easily exploitable' by Oracle, the flaw yields product compromise without credentials or user interaction. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV, but the trivial exploitation profile makes it a top patching priority.
Full takeover of Oracle Access Manager (Oracle Fusion Middleware, Authentication Engine component) is achievable by remote unauthenticated attackers over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and affects supported versions 12.2.1.4.0 and 14.1.2.1.0. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS data was not provided.
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network access fully compromise the in-memory data grid. Oracle rates this CVSS 3.1 9.8 with full confidentiality, integrity, and availability impact and describes it as easily exploitable, meaning a single crafted network interaction against a reachable cluster node can yield complete control. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low complexity and no-authentication profile make it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker with TCP network access to fully compromise the affected in-memory data grid, per Oracle's July 2026 Critical Patch Update. Oracle rates the flaw CVSS 9.8 with 'easily exploitable' language and complete confidentiality, integrity, and availability impact, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was provided.
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 is possible by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update, affecting versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates it CVSS 9.8 with full confidentiality, integrity and availability impact and describes it as 'easily exploitable,' meaning no user interaction, privileges, or special preconditions are needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity unauthenticated network profile makes it a high-priority patch.
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the network (TCP) by an unauthenticated remote attacker per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 reflects complete confidentiality, integrity, and availability loss (product takeover) with no authentication or user interaction required. No public exploit identified at time of analysis, and it is not listed in CISA KEV, so exploitation is not yet confirmed in the wild.
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Core-component flaw in Oracle Fusion Middleware releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates the issue "easily exploitable" with a CVSS 3.1 base score of 9.8 and full confidentiality, integrity and availability impact, meaning a remote actor can seize control of the in-memory data grid without credentials. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Complete compromise of Oracle Coherence (Oracle Fusion Middleware Core component) is possible by unauthenticated remote attackers sending crafted HTTP traffic, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 9.8 and results in full takeover of the Coherence data-grid instance across affected versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
Full product takeover of Oracle Coherence (Fusion Middleware, Core component) is achievable by remote unauthenticated attackers over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle characterizes it as 'easily exploitable' against supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile and complete-compromise outcome make it a top-priority patch.
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network access fully compromise affected servers (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0), disclosed in the Oracle Critical Patch Update of July 2026. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity and availability impact and is rated 'easily exploitable' by Oracle, meaning no credentials or user interaction are required. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the trivial exploitation profile makes it a high-priority patching target.