Oracle Corporation
Monthly
Takeover of Oracle Platform Security for Java (OPSS) is possible where a low-privileged attacker with HTTP network access can fully compromise the confidentiality, integrity, and availability of the service. The flaw resides in the Centralized Thirdparty Jars component and affects Oracle Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0. It carries a CVSS 3.1 base score of 8.8 and was disclosed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker over HTTP, targeting the Centralized Thirdparty Jars component. Oracle rates the flaw 8.8 and describes it as 'easily exploitable,' with successful attacks yielding complete takeover (high confidentiality, integrity, and availability impact). No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access over HTTP to take over the component, per Oracle's July 2026 Critical Patch Update. The flaw yields high confidentiality, integrity, and availability impact and is rated easily exploitable (CVSS 8.8), though no public exploit identified at time of analysis. Because OPSS underpins authentication, authorization, and credential management for the wider Fusion Middleware stack, a takeover has cascading security consequences.
Full compromise of Oracle Platform Security for Java (OPSS), a security framework within Oracle Fusion Middleware, is possible when a low-privileged attacker reaches the affected instance over HTTP via the Centralized Thirdparty Jars component. Oracle rates the flaw CVSS 3.1 8.8 and describes it as "easily exploitable," resulting in a complete takeover of OPSS with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and it is not in CISA KEV, but the low attack complexity and only a low-privilege authenticated prerequisite make it a strong candidate for prompt patching in Oracle environments.
Full compromise ("takeover") of Oracle Platform Security for Java (OPSS), a core security framework shipped inside Oracle Fusion Middleware, is possible by an unauthenticated remote attacker over HTTP against versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates this 9.8 with full confidentiality, integrity, and availability loss and describes it as "easily exploitable," so it should be treated as a top-priority patch in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile (no authentication, no user interaction) makes it an attractive target once details or patches are reverse-engineered.
Full takeover of Oracle Platform Security for Java (OPSS), a security framework within Oracle Fusion Middleware, is possible for a low-privileged attacker positioned on the same physical communication segment as the host. Disclosed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 score of 8.0 and a scope change, meaning successful exploitation can significantly impact additional products beyond OPSS itself. Exploitation is rated difficult (AC:H) and there is no public exploit identified at time of analysis, so risk is elevated by potential blast radius rather than by ease of attack.
Full takeover of Oracle Platform Security for Java (OPSS), a security framework bundled with Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0, is possible via its Centralized Thirdparty Jars component. A low-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability, though the attack is rated difficult to execute (high attack complexity). No public exploit identified at time of analysis and the flaw is not in CISA KEV, but it was disclosed by Oracle in the July 2026 Critical Patch Update.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged attacker over HTTP through the Centralized Thirdparty Jars component. Because the flaw carries a scope change, successful exploitation can result in complete takeover of OPSS and significantly impact additional connected products, earning a near-maximum CVSS 3.1 base score of 9.9. No public exploit has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a high-priority patch.
Full takeover of Oracle Platform Security for Java (OPSS) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged attacker with network access can compromise the component via crafted SOAP requests. Oracle rates this CVSS 8.8 with high confidentiality, integrity, and availability impact, meaning successful exploitation yields complete control of the OPSS component rather than mere data exposure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Platform Security for Java (OPSS), a security framework bundled with Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, allows an unauthenticated attacker with HTTP network access to fully compromise the component. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, Oracle describes it as 'easily exploitable' via the Centralized Thirdparty Jars component. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.
Complete takeover of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is possible by an unauthenticated remote attacker over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw resides in the 'Centralized Thirdparty Jars' component and carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning successful exploitation can significantly impact products beyond OPSS itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the perfect CVSS score and 'easily exploitable' vendor language make this a top-priority patch.
Unauthorized data access in Oracle Access Manager (Fusion Middleware, Authentication Engine) 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker to compromise confidentiality over HTTP, with a scope change that can significantly impact other Oracle products relying on it for single sign-on. Tagged as an Authentication Bypass, the flaw carries a CVSS 3.1 score of 8.6 and is addressed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Oracle Access Manager (Oracle Fusion Middleware, Authentication Engine) versions 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker to read and modify all data accessible to the product via crafted HTTP requests. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact, the flaw was disclosed by Oracle in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis, and the low attack complexity plus no-privilege/no-interaction requirements make it a top-priority patch for any Oracle IAM deployment.
Full takeover of Oracle Access Manager (Authentication Engine component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 is possible for a low-privileged attacker positioned on the same physical/adjacent network segment as the host running OAM. Per the CVSS vector (AV:A/AC:L/PR:L), exploitation is low-complexity and requires only some level of existing authenticated access plus adjacent network reachability, yielding complete confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis; addressed in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Identity Manager (OIM Legacy UI component) versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the identity platform. The flaw is tracked in Oracle's July 2026 Critical Patch Update and carries a CVSS 3.1 score of 8.1 with high confidentiality and integrity impact. No public exploit has been identified at time of analysis, but the low attack complexity and network vector make it a strong patching priority for enterprise IAM deployments.
Unauthorized data disclosure in Oracle Data Integrator (Oracle Fusion Middleware, Patchset Assistant component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker read all data accessible to the product over HTTP. The flaw carries a CVSS 3.1 base score of 7.5 with confidentiality-only impact and was disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis. Vendor tagging references an authentication-bypass theme, consistent with the PR:N (no-privilege) requirement.
Data compromise in Oracle MySQL Connectors (Connector/Net component) versions 9.7.0 through 9.7.1 allows a remote, unauthenticated attacker with network access via multiple protocols to read, create, delete, or modify all data accessible to the connector. Tagged as an Authentication Bypass, the flaw carries a CVSS 3.1 base score of 7.4 with full confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, and the high attack complexity (AC:H) tempers real-world exploitability.
Full takeover of Oracle MySQL Server and MySQL Cluster is possible through the Server: X Plugin component, allowing a high-privileged attacker with network access via multiple protocols to compromise confidentiality, integrity, and availability. Affected builds include MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. There is no public exploit identified at time of analysis and the flaw is not on the CISA KEV list, though Oracle rates it as easily exploitable once the required high privileges are held.
Remote unauthenticated denial-of-service and partial information disclosure affects Oracle MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1 (and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1) through the Server: X Plugin component. An attacker with only network access, using multiple protocols, can trigger a hang or repeatable crash (complete DoS) and read a subset of accessible data, carrying an Oracle-assigned CVSS 3.1 score of 8.2. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial-of-service in Oracle MySQL Router (versions 8.4.0-8.4.10 and 9.7.0-9.7.1) allows a remote unauthenticated attacker to send crafted HTTP traffic that hangs or repeatedly crashes the Router process, causing a complete availability outage. The flaw is rated CVSS 7.5 with only availability impact (no data confidentiality or integrity loss) and is described by Oracle as 'easily exploitable.' As of this analysis there is no public exploit identified and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Remote code execution / full-server takeover in Oracle WebLogic Server (Fusion Middleware Core component) allows a low-privileged attacker with network access via the RMI protocol to fully compromise the server. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, with CVSS 3.1 base score 8.8 and full confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but WebLogic RMI flaws are a historically favored target, so patching from the July 2026 Oracle CPU should be prioritized.
Server takeover in Oracle WebLogic Server (Fusion Middleware, Core component) lets an unauthenticated remote attacker fully compromise affected instances by abusing the proprietary T3 and IIOP remote protocols. Supported releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are vulnerable, and successful exploitation yields complete confidentiality, integrity and availability loss. No public exploit identified at time of analysis; the flaw is rated high complexity (CVSS 8.1) and was disclosed in Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle Coherence (part of Oracle Fusion Middleware, Core component) is possible by an unauthenticated attacker positioned on the same physical/adjacent network segment as the affected host, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and is described by Oracle as easily exploitable, though no public exploit identified at time of analysis and it is not listed in CISA KEV. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Full takeover of Oracle Coherence is possible by remote unauthenticated attackers who reach the product over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw resides in the Core component of versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 and carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity and availability impact. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.
Full takeover of Oracle Coherence (part of Oracle Fusion Middleware, Core component) is achievable by an unauthenticated remote attacker over TCP against affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates it CVSS 9.8 with high impact to confidentiality, integrity, and availability, and describes it as 'easily exploitable,' meaning no authentication, no user interaction, and low attack complexity are required. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the network-facing, unauthenticated nature makes it a high-priority patch item.
Data tampering in Oracle Coherence (Core component) of Oracle Fusion Middleware allows a low-privileged attacker with TCP network access to create, delete, or modify critical data and read a subset of accessible data. Versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected, with Oracle rating the flaw easily exploitable (CVSS 3.1 base 7.1, high integrity impact). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network access fully compromise the in-memory data grid. Oracle rates this CVSS 3.1 9.8 with full confidentiality, integrity, and availability impact and describes it as easily exploitable, meaning a single crafted network interaction against a reachable cluster node can yield complete control. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low complexity and no-authentication profile make it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Denial-of-service in Oracle Coherence (Core component) of Oracle Fusion Middleware lets an unauthenticated attacker with TCP network access hang or repeatedly crash the in-memory data grid, producing a complete availability outage. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0; the CVSS 3.1 base score is 7.5 with a pure availability impact (A:H). Oracle rates it 'easily exploitable,' but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker with TCP network access to fully compromise the affected in-memory data grid, per Oracle's July 2026 Critical Patch Update. Oracle rates the flaw CVSS 9.8 with 'easily exploitable' language and complete confidentiality, integrity, and availability impact, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was provided.
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 is possible by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update, affecting versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates it CVSS 9.8 with full confidentiality, integrity and availability impact and describes it as 'easily exploitable,' meaning no user interaction, privileges, or special preconditions are needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity unauthenticated network profile makes it a high-priority patch.
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the network (TCP) by an unauthenticated remote attacker per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 reflects complete confidentiality, integrity, and availability loss (product takeover) with no authentication or user interaction required. No public exploit identified at time of analysis, and it is not listed in CISA KEV, so exploitation is not yet confirmed in the wild.
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Core-component flaw in Oracle Fusion Middleware releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates the issue "easily exploitable" with a CVSS 3.1 base score of 9.8 and full confidentiality, integrity and availability impact, meaning a remote actor can seize control of the in-memory data grid without credentials. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Full takeover of Oracle Coherence (Fusion Middleware Core) is possible by a low-privileged network attacker over TCP in supported versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, with a scope change that can significantly impact additional co-located products beyond Coherence itself. Rated CVSS 3.1 8.5 with high confidentiality, integrity and availability impact, though the high attack complexity means exploitation is not trivial. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Oracle WebLogic Server (Oracle Fusion Middleware Core component) allows an unauthenticated attacker with network access via the SOAP protocol to fully compromise and take over the server. Affected releases are the actively supported 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions, and the flaw carries a critical CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but WebLogic RCE flaws of this class are historically weaponized rapidly.
Unauthorized data disclosure in Oracle WebLogic Server (WLS Web Services component) lets an unauthenticated remote attacker read all data accessible to the server over HTTP, with a scope change that can significantly impact additional products beyond WebLogic itself. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, addressed in Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 8.6 (confidentiality-only) and tagged as an authentication bypass; no public exploit identified at time of analysis.
Complete takeover of Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 is possible by remote, unauthenticated attackers sending crafted HTTP traffic to the Core component, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact) reflects trivially exploitable, network-facing compromise with no authentication or user interaction. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but WebLogic's history as a high-value RCE target makes this a top-priority patch.
Complete takeover of Oracle WebLogic Server is possible by unauthenticated remote attackers via HTTP against the Core component, affecting supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 9.8 (full confidentiality, integrity and availability impact), the flaw requires no privileges, no user interaction and low attack complexity. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but WebLogic's history as a mass-exploited middleware target makes rapid weaponization likely once details emerge.
Complete compromise of Oracle Coherence (Oracle Fusion Middleware Core component) is possible by unauthenticated remote attackers sending crafted HTTP traffic, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 9.8 and results in full takeover of the Coherence data-grid instance across affected versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
Full product takeover of Oracle Coherence (Fusion Middleware, Core component) is achievable by remote unauthenticated attackers over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle characterizes it as 'easily exploitable' against supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile and complete-compromise outcome make it a top-priority patch.
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network access fully compromise affected servers (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0), disclosed in the Oracle Critical Patch Update of July 2026. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity and availability impact and is rated 'easily exploitable' by Oracle, meaning no credentials or user interaction are required. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the trivial exploitation profile makes it a high-priority patching target.
Full takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) is possible by remote, unauthenticated attackers over TCP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with High impact to confidentiality, integrity, and availability, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of network reachability, no authentication, and complete compromise makes it a top-priority patch.
Full compromise of Oracle Coherence (Oracle Fusion Middleware, Core component) allows a remote, unauthenticated attacker to take over the affected server via a crafted HTTP request, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable,' affecting supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. There is no public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV; EPSS data was not provided.
Full takeover of Oracle Coherence is possible when an unauthenticated attacker reaches the product over TCP, per Oracle's July 2026 Critical Patch Update. The flaw affects the Core component across Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, and Oracle rates it CVSS 9.8 with full confidentiality, integrity and availability loss. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the 'easily exploitable / unauthenticated' characterization makes it a high-priority patch item.
Unauthorized data access in Oracle Coherence (Oracle Fusion Middleware Core component) lets an unauthenticated, network-based attacker read critical data and perform limited unauthorized modification over HTTP. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication bypass, the flaw carries CVSS 8.2 (C:H/I:L) and affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it easily exploitable with no privileges required.
Adjacent-network compromise of Oracle Coherence (Oracle Fusion Middleware Core component) lets an unauthenticated attacker on the same physical communication segment read, create, delete, or modify all Coherence-accessible data. Rated CVSS 3.1 8.1, the flaw - tagged as an authentication bypass by the reporter (Oracle) - yields high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis and not listed in CISA KEV; disclosed via the Oracle July 2026 Critical Patch Update.
Remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) allows an unauthenticated attacker with network access via HTTP/2 to fully compromise affected versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw yields complete confidentiality, integrity, and availability loss (CVSS 3.1 base 9.8) and was disclosed by Oracle in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, but the network-reachable, no-privilege, no-interaction profile makes it a top-priority patching target.
Remote unauthenticated takeover in Oracle Coherence (Oracle Fusion Middleware, Core component) allows an attacker with only HTTP network access to fully compromise the product across supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates this 9.8 (Critical) with full confidentiality, integrity, and availability impact and describes it as easily exploitable, meaning no authentication, credentials, or user interaction are needed. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated network reach and complete compromise makes this a high-priority patch item.
Full remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) versions 12.2.1.4.0 and 14.1.1.0.0 is possible by an unauthenticated attacker sending crafted traffic over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is rated by Oracle as 'easily exploitable,' meaning no special skill or configuration is needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication profile makes it a high-priority patch target.
Full takeover of Oracle Coherence is possible by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw affects the Core component across Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, and yields complete loss of confidentiality, integrity and availability (CVSS 3.1 8.1). Exploitation is rated high-complexity, and no public exploit has been identified at time of analysis.
Complete takeover of Oracle Coherence is possible when an unauthenticated remote attacker reaches the Core component over HTTPS, per Oracle's July 2026 Critical Patch Update. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and the CVSS 3.1 base score of 9.8 reflects full confidentiality, integrity, and availability compromise with no privileges or user interaction. No public exploit identified at time of analysis, but the low attack complexity and 'easily exploitable' framing from Oracle make this a high-priority patch.
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware allows an unauthenticated attacker to remotely compromise affected instances over HTTP, impacting confidentiality, integrity, and availability. Oracle rates this CVSS 9.8 and describes it as easily exploitable against supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and absence of any authentication requirement make it a top-tier patching priority.
Complete takeover of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible for a remote unauthenticated attacker who can reach the product over TCP, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) reflects that no authentication or user interaction is required and that a successful attack fully compromises confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but Oracle rates it 'easily exploitable,' making it a high-priority patch in the July 2026 Critical Patch Update.
Full takeover of Oracle Coherence is possible when a remote, unauthenticated attacker reaches the product over TCP and successfully exploits a hard-to-trigger flaw in the Core component, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 8.1). Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, all addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware (Core component), is possible by remote unauthenticated attackers over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 and Oracle describes it as easily exploitable, allowing complete takeover with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Local privilege-based takeover in Oracle Coherence (component: Core) allows a low-privileged attacker with logon access to the host where Coherence executes to fully compromise the product, yielding high confidentiality, integrity, and availability impact. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote takeover of Oracle Coherence (Core component) allows an unauthenticated attacker with TCP network access to fully compromise the in-memory data grid, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and no required privileges or user interaction. No public exploit identified at time of analysis, but the trivial exploitability and full-takeover impact make this a high-priority patch for affected Fusion Middleware deployments.
Full takeover of Oracle Coherence (Fusion Middleware Core component) is possible by a low-privileged attacker with TCP network access to an affected instance, per Oracle's July 2026 Critical Patch Update. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, carrying a CVSS 3.1 base score of 8.8 with high confidentiality, integrity and availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the 'easily exploitable' rating combined with complete-compromise impact makes it a priority patch.
Data compromise in Oracle Coherence (Oracle Fusion Middleware Core component) lets an unauthenticated attacker with network access via TLS read, create, delete, or modify all Coherence-accessible data. Oracle rates it 9.1 (CVSS 3.1) with high confidentiality and integrity impact but no availability impact, and the intelligence tags flag it as an authentication bypass. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) lets an unauthenticated attacker with only HTTP/2 network reachability fully compromise the affected data-grid instance. Supported versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected, and Oracle rates the flaw CVSS 9.8 with high confidentiality, integrity and availability impact. No public exploit has been identified at time of analysis and it is not in CISA KEV, but the easily exploitable, network-facing, unauthenticated nature makes this a top-priority patch.
Unauthenticated data disclosure in Oracle Coherence (Oracle Fusion Middleware, Core component) versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 lets a remote attacker with only TCP network access read or fully access all Coherence-managed data. Oracle rates it CVSS 3.1 7.5 with confidentiality-only impact and classifies it as easily exploitable; the 'Authentication Bypass' tag indicates the flaw circumvents access controls to expose cluster data. No public exploit identified at time of analysis, and no EPSS or CISA KEV signal is present in the provided data.
Remote takeover of Oracle Coherence (Fusion Middleware Core component) allows an unauthenticated network attacker to fully compromise the affected instance over TCP, per Oracle's July 2026 Critical Patch Update. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, all carrying a CVSS 3.1 base score of 9.8 with full confidentiality, integrity and availability impact. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the 'easily exploitable / unauthenticated / network' profile makes it a high-priority patch item.
Full compromise of Oracle Coherence (Core component) is possible for an unauthenticated attacker who can reach the cluster's physical communication segment, per Oracle's July 2026 Critical Patch Update. Affected releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 can be taken over completely, yielding high confidentiality, integrity, and availability impact (CVSS 8.8, AV:A). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but Oracle rates it 'easily exploitable' with no privileges or user interaction required.
Full compromise of Oracle Coherence (Oracle Fusion Middleware Core component) is possible by a remote, unauthenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 9.8 and Oracle rates it 'easily exploitable,' with successful attacks resulting in complete takeover of the Coherence instance (full confidentiality, integrity, and availability loss). No public exploit has been identified at time of analysis, but the low attack complexity and lack of authentication make it a high-priority patch.
Remote takeover of Oracle Coherence (Core component of Oracle Fusion Middleware) allows an unauthenticated attacker with TCP network access to fully compromise the affected data-grid instance across versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates it "easily exploitable" with a CVSS 3.1 base score of 9.8 and full confidentiality, integrity and availability impact. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication profile makes it a high-priority patch target.
Full remote takeover of Oracle Coherence (Core component of Oracle Fusion Middleware) is achievable by an unauthenticated network attacker in supported releases 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates the flaw CVSS 9.8 and describes it as 'easily exploitable' over TCP with no user interaction, yielding complete compromise of confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the low attack complexity and unauthenticated network vector make it a top-priority patch from the July 2026 Critical Patch Update.
Full compromise of Oracle Coherence (Fusion Middleware Core component) is achievable by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 9.8 rating and permits complete takeover with high confidentiality, integrity, and availability impact against versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit identified at time of analysis, and it is not listed in CISA KEV; however, the low attack complexity and unauthenticated network vector make it a high-priority patch target.
Denial of service and data tampering in Oracle Coherence (Oracle Fusion Middleware, Core component) lets a remote unauthenticated attacker with TCP network access hang or repeatedly crash the in-memory data grid and perform unauthorized update, insert, or delete of some accessible data. Oracle rates it CVSS 3.1 8.2 and describes it as 'easily exploitable', reflecting no authentication and low attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote takeover of Oracle Coherence (a component of Oracle Fusion Middleware, Core component) lets a network attacker with only TCP connectivity fully compromise the affected instance, per Oracle's July 2026 Critical Patch Update. Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected, and the CVSS 3.1 base score of 9.8 reflects complete loss of confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the 'easily exploitable / unauthenticated' framing makes it a high-priority patch.
Full compromise of Oracle Coherence, the in-memory data grid component of Oracle Fusion Middleware (Core), allows an unauthenticated remote attacker with only TCP network access to take over the affected instance. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, it affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and was disclosed by Oracle in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided in the input.
Denial of service in Oracle Coherence (Core component) of Oracle Fusion Middleware allows a remote, unauthenticated attacker with TCP network access to trigger a hang or repeatable crash, producing a complete availability outage of the affected Coherence instance. It affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, carries a CVSS 3.1 base score of 7.5 (availability-only), and is described by Oracle as easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) allows an unauthenticated attacker with TCP network access to fully compromise the product across supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates this CVSS 9.8 with high confidentiality, integrity, and availability impact, and describes it as 'easily exploitable,' meaning no authentication, user interaction, or special conditions are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and complete-takeover impact make it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Full compromise of Oracle Coherence (Oracle Fusion Middleware Core) is possible by unauthenticated attackers with TCP network access, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 9.8 and described by Oracle as 'easily exploitable,' allowing complete takeover of the in-memory data grid across supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-takeover profile makes it a high-priority patch.
Full compromise of Oracle Coherence (Oracle Fusion Middleware, Core component) is possible for a low-privileged attacker positioned on the same physical/logical network segment as the host, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.0 with a scope change, meaning successful exploitation not only results in takeover of Coherence itself but can significantly impact other products sharing the environment. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Coherence (Fusion Middleware Core component) is possible by an unauthenticated attacker who holds a local logon on the host where Coherence runs, per Oracle's July 2026 Critical Patch Update. The flaw scores CVSS 9.3 because a successful attack yields complete confidentiality, integrity, and availability loss and, via a scope change, can significantly impact additional products beyond Coherence itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable.'
Remote takeover of Oracle Coherence (Oracle Fusion Middleware Core component) affects versions 12.2.1.4.0 and 14.1.1.0.0, allowing an unauthenticated attacker with only HTTP network access to fully compromise the product. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, Oracle describes the flaw as easily exploitable and resulting in complete Coherence takeover. Addressed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not currently listed in CISA KEV.
Complete takeover of Oracle Coherence is possible by unauthenticated remote attackers over TCP against the Core component in Oracle Fusion Middleware versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates this 'easily exploitable' with full confidentiality, integrity, and availability compromise (CVSS 9.8), fixed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and the flaw is not on CISA KEV, so exploitation is currently theoretical but the barrier is minimal.
Privilege escalation with scope change in Oracle Coherence (Oracle Fusion Middleware Core component) lets a low-privileged attacker with local logon access compromise the confidentiality and integrity of all Coherence-accessible data and impact additional products beyond Coherence itself. Oracle rates it CVSS 3.1 7.2, but the attack is hard to execute: it requires an existing account, high attack complexity, and human interaction from a separate victim. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the fix ships in Oracle's July 2026 Critical Patch Update.
Full remote takeover of Oracle Coherence (part of Oracle Fusion Middleware, Core component) in versions 12.2.1.4.0 and 14.1.1.0.0 is achievable by an unauthenticated attacker with only HTTP network access, per the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N with High Confidentiality, Integrity, and Availability impact (base score 9.8). Oracle rates it 'easily exploitable' and describes the outcome as complete compromise of Coherence. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial-access profile makes it a high-priority patch in the Oracle July 2026 Critical Patch Update.
Full remote takeover in Oracle Coherence 12.2.1.4.0 and 14.1.1.0.0 (Fusion Middleware Core component) allows an unauthenticated network attacker to compromise the in-memory data grid over HTTP with no user interaction. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, it was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'easily exploitable, unauthenticated' profile makes it a prime patching priority.
Remote code execution and full takeover in Oracle Coherence (Oracle Fusion Middleware, Core component) versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows an unauthenticated attacker with HTTP network access to completely compromise the product, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector and 'takeover' impact make it a top-priority patch candidate.
Remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) allows an unauthenticated attacker with TCP network access to fully compromise the product across supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates this 'easily exploitable' with complete confidentiality, integrity and availability loss (CVSS 9.8), disclosed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing nature makes it a high-priority patch.
Authentication bypass and data compromise in Oracle Coherence (Oracle Fusion Middleware Core component) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 allows a low-privileged, network-adjacent attacker to read, create, delete or modify all Coherence-accessible data over HTTP. Because the flaw carries a scope change, successful exploitation can significantly impact additional products beyond Coherence itself, yielding a CVSS 3.1 score of 9.6. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a high-priority patch item.
Full takeover of Oracle Coherence (an in-memory data grid within Oracle Fusion Middleware) is achievable by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch item.
Denial-of-service with data tampering in Oracle Coherence 15.1.1.0.0 (Fusion Middleware Core) lets an unauthenticated network attacker hang or repeatedly crash the in-memory data grid over TCP, while also gaining limited unauthorized read and write access to a subset of grid-managed data. Rated CVSS 3.1 8.6 by Oracle and described as 'easily exploitable,' the flaw requires no authentication or user interaction. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Remote takeover of Oracle Coherence (a component of Oracle Fusion Middleware) allows an unauthenticated attacker with TCP network access to fully compromise the affected in-memory data grid, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) reflects complete loss of confidentiality, integrity, and availability with no authentication or user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'easily exploitable' framing and full-impact vector make this a high-priority patch across affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Full takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) can be achieved by unauthenticated remote attackers sending crafted HTTP traffic, affecting versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates this CVSS 9.8 with complete confidentiality, integrity, and availability loss, and describes it as 'easily exploitable,' meaning no authentication, user interaction, or special preconditions are required. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Remote unauthenticated compromise of Oracle Coherence (a component of Oracle Fusion Middleware) allows attackers with only network TCP access to fully take over the affected instance, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 9.8 and affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit identified at time of analysis, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) and full confidentiality, integrity, and availability impact make this a high-priority patch item.
Remote takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware allows an unauthenticated attacker with only TCP network access to fully compromise the in-memory data grid, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score is 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the combination of no authentication and full-system takeover makes it a top-priority patch.
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with network access over TCP reaches the Core component, yielding full confidentiality, integrity, and availability compromise (CVSS 9.8). The flaw affects Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 shipped as part of Oracle Fusion Middleware, and is addressed in the Oracle Critical Patch Update of July 2026. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Takeover of Oracle Platform Security for Java (OPSS) is possible where a low-privileged attacker with HTTP network access can fully compromise the confidentiality, integrity, and availability of the service. The flaw resides in the Centralized Thirdparty Jars component and affects Oracle Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0. It carries a CVSS 3.1 base score of 8.8 and was disclosed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker over HTTP, targeting the Centralized Thirdparty Jars component. Oracle rates the flaw 8.8 and describes it as 'easily exploitable,' with successful attacks yielding complete takeover (high confidentiality, integrity, and availability impact). No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access over HTTP to take over the component, per Oracle's July 2026 Critical Patch Update. The flaw yields high confidentiality, integrity, and availability impact and is rated easily exploitable (CVSS 8.8), though no public exploit identified at time of analysis. Because OPSS underpins authentication, authorization, and credential management for the wider Fusion Middleware stack, a takeover has cascading security consequences.
Full compromise of Oracle Platform Security for Java (OPSS), a security framework within Oracle Fusion Middleware, is possible when a low-privileged attacker reaches the affected instance over HTTP via the Centralized Thirdparty Jars component. Oracle rates the flaw CVSS 3.1 8.8 and describes it as "easily exploitable," resulting in a complete takeover of OPSS with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and it is not in CISA KEV, but the low attack complexity and only a low-privilege authenticated prerequisite make it a strong candidate for prompt patching in Oracle environments.
Full compromise ("takeover") of Oracle Platform Security for Java (OPSS), a core security framework shipped inside Oracle Fusion Middleware, is possible by an unauthenticated remote attacker over HTTP against versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates this 9.8 with full confidentiality, integrity, and availability loss and describes it as "easily exploitable," so it should be treated as a top-priority patch in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile (no authentication, no user interaction) makes it an attractive target once details or patches are reverse-engineered.
Full takeover of Oracle Platform Security for Java (OPSS), a security framework within Oracle Fusion Middleware, is possible for a low-privileged attacker positioned on the same physical communication segment as the host. Disclosed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 score of 8.0 and a scope change, meaning successful exploitation can significantly impact additional products beyond OPSS itself. Exploitation is rated difficult (AC:H) and there is no public exploit identified at time of analysis, so risk is elevated by potential blast radius rather than by ease of attack.
Full takeover of Oracle Platform Security for Java (OPSS), a security framework bundled with Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0, is possible via its Centralized Thirdparty Jars component. A low-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability, though the attack is rated difficult to execute (high attack complexity). No public exploit identified at time of analysis and the flaw is not in CISA KEV, but it was disclosed by Oracle in the July 2026 Critical Patch Update.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged attacker over HTTP through the Centralized Thirdparty Jars component. Because the flaw carries a scope change, successful exploitation can result in complete takeover of OPSS and significantly impact additional connected products, earning a near-maximum CVSS 3.1 base score of 9.9. No public exploit has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a high-priority patch.
Full takeover of Oracle Platform Security for Java (OPSS) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged attacker with network access can compromise the component via crafted SOAP requests. Oracle rates this CVSS 8.8 with high confidentiality, integrity, and availability impact, meaning successful exploitation yields complete control of the OPSS component rather than mere data exposure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Platform Security for Java (OPSS), a security framework bundled with Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, allows an unauthenticated attacker with HTTP network access to fully compromise the component. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, Oracle describes it as 'easily exploitable' via the Centralized Thirdparty Jars component. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.
Complete takeover of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is possible by an unauthenticated remote attacker over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw resides in the 'Centralized Thirdparty Jars' component and carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning successful exploitation can significantly impact products beyond OPSS itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the perfect CVSS score and 'easily exploitable' vendor language make this a top-priority patch.
Unauthorized data access in Oracle Access Manager (Fusion Middleware, Authentication Engine) 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker to compromise confidentiality over HTTP, with a scope change that can significantly impact other Oracle products relying on it for single sign-on. Tagged as an Authentication Bypass, the flaw carries a CVSS 3.1 score of 8.6 and is addressed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Oracle Access Manager (Oracle Fusion Middleware, Authentication Engine) versions 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker to read and modify all data accessible to the product via crafted HTTP requests. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact, the flaw was disclosed by Oracle in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis, and the low attack complexity plus no-privilege/no-interaction requirements make it a top-priority patch for any Oracle IAM deployment.
Full takeover of Oracle Access Manager (Authentication Engine component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 is possible for a low-privileged attacker positioned on the same physical/adjacent network segment as the host running OAM. Per the CVSS vector (AV:A/AC:L/PR:L), exploitation is low-complexity and requires only some level of existing authenticated access plus adjacent network reachability, yielding complete confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis; addressed in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Identity Manager (OIM Legacy UI component) versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the identity platform. The flaw is tracked in Oracle's July 2026 Critical Patch Update and carries a CVSS 3.1 score of 8.1 with high confidentiality and integrity impact. No public exploit has been identified at time of analysis, but the low attack complexity and network vector make it a strong patching priority for enterprise IAM deployments.
Unauthorized data disclosure in Oracle Data Integrator (Oracle Fusion Middleware, Patchset Assistant component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker read all data accessible to the product over HTTP. The flaw carries a CVSS 3.1 base score of 7.5 with confidentiality-only impact and was disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis. Vendor tagging references an authentication-bypass theme, consistent with the PR:N (no-privilege) requirement.
Data compromise in Oracle MySQL Connectors (Connector/Net component) versions 9.7.0 through 9.7.1 allows a remote, unauthenticated attacker with network access via multiple protocols to read, create, delete, or modify all data accessible to the connector. Tagged as an Authentication Bypass, the flaw carries a CVSS 3.1 base score of 7.4 with full confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, and the high attack complexity (AC:H) tempers real-world exploitability.
Full takeover of Oracle MySQL Server and MySQL Cluster is possible through the Server: X Plugin component, allowing a high-privileged attacker with network access via multiple protocols to compromise confidentiality, integrity, and availability. Affected builds include MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. There is no public exploit identified at time of analysis and the flaw is not on the CISA KEV list, though Oracle rates it as easily exploitable once the required high privileges are held.
Remote unauthenticated denial-of-service and partial information disclosure affects Oracle MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1 (and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1) through the Server: X Plugin component. An attacker with only network access, using multiple protocols, can trigger a hang or repeatable crash (complete DoS) and read a subset of accessible data, carrying an Oracle-assigned CVSS 3.1 score of 8.2. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial-of-service in Oracle MySQL Router (versions 8.4.0-8.4.10 and 9.7.0-9.7.1) allows a remote unauthenticated attacker to send crafted HTTP traffic that hangs or repeatedly crashes the Router process, causing a complete availability outage. The flaw is rated CVSS 7.5 with only availability impact (no data confidentiality or integrity loss) and is described by Oracle as 'easily exploitable.' As of this analysis there is no public exploit identified and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Remote code execution / full-server takeover in Oracle WebLogic Server (Fusion Middleware Core component) allows a low-privileged attacker with network access via the RMI protocol to fully compromise the server. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, with CVSS 3.1 base score 8.8 and full confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but WebLogic RMI flaws are a historically favored target, so patching from the July 2026 Oracle CPU should be prioritized.
Server takeover in Oracle WebLogic Server (Fusion Middleware, Core component) lets an unauthenticated remote attacker fully compromise affected instances by abusing the proprietary T3 and IIOP remote protocols. Supported releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are vulnerable, and successful exploitation yields complete confidentiality, integrity and availability loss. No public exploit identified at time of analysis; the flaw is rated high complexity (CVSS 8.1) and was disclosed in Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle Coherence (part of Oracle Fusion Middleware, Core component) is possible by an unauthenticated attacker positioned on the same physical/adjacent network segment as the affected host, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and is described by Oracle as easily exploitable, though no public exploit identified at time of analysis and it is not listed in CISA KEV. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Full takeover of Oracle Coherence is possible by remote unauthenticated attackers who reach the product over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw resides in the Core component of versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 and carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity and availability impact. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.
Full takeover of Oracle Coherence (part of Oracle Fusion Middleware, Core component) is achievable by an unauthenticated remote attacker over TCP against affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates it CVSS 9.8 with high impact to confidentiality, integrity, and availability, and describes it as 'easily exploitable,' meaning no authentication, no user interaction, and low attack complexity are required. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the network-facing, unauthenticated nature makes it a high-priority patch item.
Data tampering in Oracle Coherence (Core component) of Oracle Fusion Middleware allows a low-privileged attacker with TCP network access to create, delete, or modify critical data and read a subset of accessible data. Versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected, with Oracle rating the flaw easily exploitable (CVSS 3.1 base 7.1, high integrity impact). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network access fully compromise the in-memory data grid. Oracle rates this CVSS 3.1 9.8 with full confidentiality, integrity, and availability impact and describes it as easily exploitable, meaning a single crafted network interaction against a reachable cluster node can yield complete control. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low complexity and no-authentication profile make it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Denial-of-service in Oracle Coherence (Core component) of Oracle Fusion Middleware lets an unauthenticated attacker with TCP network access hang or repeatedly crash the in-memory data grid, producing a complete availability outage. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0; the CVSS 3.1 base score is 7.5 with a pure availability impact (A:H). Oracle rates it 'easily exploitable,' but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker with TCP network access to fully compromise the affected in-memory data grid, per Oracle's July 2026 Critical Patch Update. Oracle rates the flaw CVSS 9.8 with 'easily exploitable' language and complete confidentiality, integrity, and availability impact, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was provided.
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 is possible by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update, affecting versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates it CVSS 9.8 with full confidentiality, integrity and availability impact and describes it as 'easily exploitable,' meaning no user interaction, privileges, or special preconditions are needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity unauthenticated network profile makes it a high-priority patch.
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the network (TCP) by an unauthenticated remote attacker per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 reflects complete confidentiality, integrity, and availability loss (product takeover) with no authentication or user interaction required. No public exploit identified at time of analysis, and it is not listed in CISA KEV, so exploitation is not yet confirmed in the wild.
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Core-component flaw in Oracle Fusion Middleware releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates the issue "easily exploitable" with a CVSS 3.1 base score of 9.8 and full confidentiality, integrity and availability impact, meaning a remote actor can seize control of the in-memory data grid without credentials. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Full takeover of Oracle Coherence (Fusion Middleware Core) is possible by a low-privileged network attacker over TCP in supported versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, with a scope change that can significantly impact additional co-located products beyond Coherence itself. Rated CVSS 3.1 8.5 with high confidentiality, integrity and availability impact, though the high attack complexity means exploitation is not trivial. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Oracle WebLogic Server (Oracle Fusion Middleware Core component) allows an unauthenticated attacker with network access via the SOAP protocol to fully compromise and take over the server. Affected releases are the actively supported 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions, and the flaw carries a critical CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but WebLogic RCE flaws of this class are historically weaponized rapidly.
Unauthorized data disclosure in Oracle WebLogic Server (WLS Web Services component) lets an unauthenticated remote attacker read all data accessible to the server over HTTP, with a scope change that can significantly impact additional products beyond WebLogic itself. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, addressed in Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 8.6 (confidentiality-only) and tagged as an authentication bypass; no public exploit identified at time of analysis.
Complete takeover of Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 is possible by remote, unauthenticated attackers sending crafted HTTP traffic to the Core component, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact) reflects trivially exploitable, network-facing compromise with no authentication or user interaction. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but WebLogic's history as a high-value RCE target makes this a top-priority patch.
Complete takeover of Oracle WebLogic Server is possible by unauthenticated remote attackers via HTTP against the Core component, affecting supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 9.8 (full confidentiality, integrity and availability impact), the flaw requires no privileges, no user interaction and low attack complexity. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but WebLogic's history as a mass-exploited middleware target makes rapid weaponization likely once details emerge.
Complete compromise of Oracle Coherence (Oracle Fusion Middleware Core component) is possible by unauthenticated remote attackers sending crafted HTTP traffic, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 9.8 and results in full takeover of the Coherence data-grid instance across affected versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
Full product takeover of Oracle Coherence (Fusion Middleware, Core component) is achievable by remote unauthenticated attackers over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle characterizes it as 'easily exploitable' against supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile and complete-compromise outcome make it a top-priority patch.
Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network access fully compromise affected servers (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0), disclosed in the Oracle Critical Patch Update of July 2026. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity and availability impact and is rated 'easily exploitable' by Oracle, meaning no credentials or user interaction are required. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the trivial exploitation profile makes it a high-priority patching target.
Full takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) is possible by remote, unauthenticated attackers over TCP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with High impact to confidentiality, integrity, and availability, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of network reachability, no authentication, and complete compromise makes it a top-priority patch.
Full compromise of Oracle Coherence (Oracle Fusion Middleware, Core component) allows a remote, unauthenticated attacker to take over the affected server via a crafted HTTP request, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable,' affecting supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. There is no public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV; EPSS data was not provided.
Full takeover of Oracle Coherence is possible when an unauthenticated attacker reaches the product over TCP, per Oracle's July 2026 Critical Patch Update. The flaw affects the Core component across Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, and Oracle rates it CVSS 9.8 with full confidentiality, integrity and availability loss. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the 'easily exploitable / unauthenticated' characterization makes it a high-priority patch item.
Unauthorized data access in Oracle Coherence (Oracle Fusion Middleware Core component) lets an unauthenticated, network-based attacker read critical data and perform limited unauthorized modification over HTTP. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication bypass, the flaw carries CVSS 8.2 (C:H/I:L) and affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it easily exploitable with no privileges required.
Adjacent-network compromise of Oracle Coherence (Oracle Fusion Middleware Core component) lets an unauthenticated attacker on the same physical communication segment read, create, delete, or modify all Coherence-accessible data. Rated CVSS 3.1 8.1, the flaw - tagged as an authentication bypass by the reporter (Oracle) - yields high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis and not listed in CISA KEV; disclosed via the Oracle July 2026 Critical Patch Update.
Remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) allows an unauthenticated attacker with network access via HTTP/2 to fully compromise affected versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw yields complete confidentiality, integrity, and availability loss (CVSS 3.1 base 9.8) and was disclosed by Oracle in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, but the network-reachable, no-privilege, no-interaction profile makes it a top-priority patching target.
Remote unauthenticated takeover in Oracle Coherence (Oracle Fusion Middleware, Core component) allows an attacker with only HTTP network access to fully compromise the product across supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates this 9.8 (Critical) with full confidentiality, integrity, and availability impact and describes it as easily exploitable, meaning no authentication, credentials, or user interaction are needed. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated network reach and complete compromise makes this a high-priority patch item.
Full remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) versions 12.2.1.4.0 and 14.1.1.0.0 is possible by an unauthenticated attacker sending crafted traffic over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is rated by Oracle as 'easily exploitable,' meaning no special skill or configuration is needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication profile makes it a high-priority patch target.
Full takeover of Oracle Coherence is possible by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw affects the Core component across Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, and yields complete loss of confidentiality, integrity and availability (CVSS 3.1 8.1). Exploitation is rated high-complexity, and no public exploit has been identified at time of analysis.
Complete takeover of Oracle Coherence is possible when an unauthenticated remote attacker reaches the Core component over HTTPS, per Oracle's July 2026 Critical Patch Update. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and the CVSS 3.1 base score of 9.8 reflects full confidentiality, integrity, and availability compromise with no privileges or user interaction. No public exploit identified at time of analysis, but the low attack complexity and 'easily exploitable' framing from Oracle make this a high-priority patch.
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware allows an unauthenticated attacker to remotely compromise affected instances over HTTP, impacting confidentiality, integrity, and availability. Oracle rates this CVSS 9.8 and describes it as easily exploitable against supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and absence of any authentication requirement make it a top-tier patching priority.
Complete takeover of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible for a remote unauthenticated attacker who can reach the product over TCP, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) reflects that no authentication or user interaction is required and that a successful attack fully compromises confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but Oracle rates it 'easily exploitable,' making it a high-priority patch in the July 2026 Critical Patch Update.
Full takeover of Oracle Coherence is possible when a remote, unauthenticated attacker reaches the product over TCP and successfully exploits a hard-to-trigger flaw in the Core component, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 8.1). Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, all addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware (Core component), is possible by remote unauthenticated attackers over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 and Oracle describes it as easily exploitable, allowing complete takeover with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Local privilege-based takeover in Oracle Coherence (component: Core) allows a low-privileged attacker with logon access to the host where Coherence executes to fully compromise the product, yielding high confidentiality, integrity, and availability impact. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote takeover of Oracle Coherence (Core component) allows an unauthenticated attacker with TCP network access to fully compromise the in-memory data grid, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and no required privileges or user interaction. No public exploit identified at time of analysis, but the trivial exploitability and full-takeover impact make this a high-priority patch for affected Fusion Middleware deployments.
Full takeover of Oracle Coherence (Fusion Middleware Core component) is possible by a low-privileged attacker with TCP network access to an affected instance, per Oracle's July 2026 Critical Patch Update. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, carrying a CVSS 3.1 base score of 8.8 with high confidentiality, integrity and availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the 'easily exploitable' rating combined with complete-compromise impact makes it a priority patch.
Data compromise in Oracle Coherence (Oracle Fusion Middleware Core component) lets an unauthenticated attacker with network access via TLS read, create, delete, or modify all Coherence-accessible data. Oracle rates it 9.1 (CVSS 3.1) with high confidentiality and integrity impact but no availability impact, and the intelligence tags flag it as an authentication bypass. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) lets an unauthenticated attacker with only HTTP/2 network reachability fully compromise the affected data-grid instance. Supported versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected, and Oracle rates the flaw CVSS 9.8 with high confidentiality, integrity and availability impact. No public exploit has been identified at time of analysis and it is not in CISA KEV, but the easily exploitable, network-facing, unauthenticated nature makes this a top-priority patch.
Unauthenticated data disclosure in Oracle Coherence (Oracle Fusion Middleware, Core component) versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 lets a remote attacker with only TCP network access read or fully access all Coherence-managed data. Oracle rates it CVSS 3.1 7.5 with confidentiality-only impact and classifies it as easily exploitable; the 'Authentication Bypass' tag indicates the flaw circumvents access controls to expose cluster data. No public exploit identified at time of analysis, and no EPSS or CISA KEV signal is present in the provided data.
Remote takeover of Oracle Coherence (Fusion Middleware Core component) allows an unauthenticated network attacker to fully compromise the affected instance over TCP, per Oracle's July 2026 Critical Patch Update. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, all carrying a CVSS 3.1 base score of 9.8 with full confidentiality, integrity and availability impact. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the 'easily exploitable / unauthenticated / network' profile makes it a high-priority patch item.
Full compromise of Oracle Coherence (Core component) is possible for an unauthenticated attacker who can reach the cluster's physical communication segment, per Oracle's July 2026 Critical Patch Update. Affected releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 can be taken over completely, yielding high confidentiality, integrity, and availability impact (CVSS 8.8, AV:A). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but Oracle rates it 'easily exploitable' with no privileges or user interaction required.
Full compromise of Oracle Coherence (Oracle Fusion Middleware Core component) is possible by a remote, unauthenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 9.8 and Oracle rates it 'easily exploitable,' with successful attacks resulting in complete takeover of the Coherence instance (full confidentiality, integrity, and availability loss). No public exploit has been identified at time of analysis, but the low attack complexity and lack of authentication make it a high-priority patch.
Remote takeover of Oracle Coherence (Core component of Oracle Fusion Middleware) allows an unauthenticated attacker with TCP network access to fully compromise the affected data-grid instance across versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates it "easily exploitable" with a CVSS 3.1 base score of 9.8 and full confidentiality, integrity and availability impact. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication profile makes it a high-priority patch target.
Full remote takeover of Oracle Coherence (Core component of Oracle Fusion Middleware) is achievable by an unauthenticated network attacker in supported releases 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates the flaw CVSS 9.8 and describes it as 'easily exploitable' over TCP with no user interaction, yielding complete compromise of confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the low attack complexity and unauthenticated network vector make it a top-priority patch from the July 2026 Critical Patch Update.
Full compromise of Oracle Coherence (Fusion Middleware Core component) is achievable by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 9.8 rating and permits complete takeover with high confidentiality, integrity, and availability impact against versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit identified at time of analysis, and it is not listed in CISA KEV; however, the low attack complexity and unauthenticated network vector make it a high-priority patch target.
Denial of service and data tampering in Oracle Coherence (Oracle Fusion Middleware, Core component) lets a remote unauthenticated attacker with TCP network access hang or repeatedly crash the in-memory data grid and perform unauthorized update, insert, or delete of some accessible data. Oracle rates it CVSS 3.1 8.2 and describes it as 'easily exploitable', reflecting no authentication and low attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote takeover of Oracle Coherence (a component of Oracle Fusion Middleware, Core component) lets a network attacker with only TCP connectivity fully compromise the affected instance, per Oracle's July 2026 Critical Patch Update. Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected, and the CVSS 3.1 base score of 9.8 reflects complete loss of confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the 'easily exploitable / unauthenticated' framing makes it a high-priority patch.
Full compromise of Oracle Coherence, the in-memory data grid component of Oracle Fusion Middleware (Core), allows an unauthenticated remote attacker with only TCP network access to take over the affected instance. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, it affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and was disclosed by Oracle in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided in the input.
Denial of service in Oracle Coherence (Core component) of Oracle Fusion Middleware allows a remote, unauthenticated attacker with TCP network access to trigger a hang or repeatable crash, producing a complete availability outage of the affected Coherence instance. It affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, carries a CVSS 3.1 base score of 7.5 (availability-only), and is described by Oracle as easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) allows an unauthenticated attacker with TCP network access to fully compromise the product across supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates this CVSS 9.8 with high confidentiality, integrity, and availability impact, and describes it as 'easily exploitable,' meaning no authentication, user interaction, or special conditions are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and complete-takeover impact make it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Full compromise of Oracle Coherence (Oracle Fusion Middleware Core) is possible by unauthenticated attackers with TCP network access, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 9.8 and described by Oracle as 'easily exploitable,' allowing complete takeover of the in-memory data grid across supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-takeover profile makes it a high-priority patch.
Full compromise of Oracle Coherence (Oracle Fusion Middleware, Core component) is possible for a low-privileged attacker positioned on the same physical/logical network segment as the host, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.0 with a scope change, meaning successful exploitation not only results in takeover of Coherence itself but can significantly impact other products sharing the environment. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Coherence (Fusion Middleware Core component) is possible by an unauthenticated attacker who holds a local logon on the host where Coherence runs, per Oracle's July 2026 Critical Patch Update. The flaw scores CVSS 9.3 because a successful attack yields complete confidentiality, integrity, and availability loss and, via a scope change, can significantly impact additional products beyond Coherence itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable.'
Remote takeover of Oracle Coherence (Oracle Fusion Middleware Core component) affects versions 12.2.1.4.0 and 14.1.1.0.0, allowing an unauthenticated attacker with only HTTP network access to fully compromise the product. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, Oracle describes the flaw as easily exploitable and resulting in complete Coherence takeover. Addressed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not currently listed in CISA KEV.
Complete takeover of Oracle Coherence is possible by unauthenticated remote attackers over TCP against the Core component in Oracle Fusion Middleware versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates this 'easily exploitable' with full confidentiality, integrity, and availability compromise (CVSS 9.8), fixed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and the flaw is not on CISA KEV, so exploitation is currently theoretical but the barrier is minimal.
Privilege escalation with scope change in Oracle Coherence (Oracle Fusion Middleware Core component) lets a low-privileged attacker with local logon access compromise the confidentiality and integrity of all Coherence-accessible data and impact additional products beyond Coherence itself. Oracle rates it CVSS 3.1 7.2, but the attack is hard to execute: it requires an existing account, high attack complexity, and human interaction from a separate victim. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the fix ships in Oracle's July 2026 Critical Patch Update.
Full remote takeover of Oracle Coherence (part of Oracle Fusion Middleware, Core component) in versions 12.2.1.4.0 and 14.1.1.0.0 is achievable by an unauthenticated attacker with only HTTP network access, per the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N with High Confidentiality, Integrity, and Availability impact (base score 9.8). Oracle rates it 'easily exploitable' and describes the outcome as complete compromise of Coherence. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial-access profile makes it a high-priority patch in the Oracle July 2026 Critical Patch Update.
Full remote takeover in Oracle Coherence 12.2.1.4.0 and 14.1.1.0.0 (Fusion Middleware Core component) allows an unauthenticated network attacker to compromise the in-memory data grid over HTTP with no user interaction. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, it was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'easily exploitable, unauthenticated' profile makes it a prime patching priority.
Remote code execution and full takeover in Oracle Coherence (Oracle Fusion Middleware, Core component) versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows an unauthenticated attacker with HTTP network access to completely compromise the product, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector and 'takeover' impact make it a top-priority patch candidate.
Remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) allows an unauthenticated attacker with TCP network access to fully compromise the product across supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates this 'easily exploitable' with complete confidentiality, integrity and availability loss (CVSS 9.8), disclosed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing nature makes it a high-priority patch.
Authentication bypass and data compromise in Oracle Coherence (Oracle Fusion Middleware Core component) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 allows a low-privileged, network-adjacent attacker to read, create, delete or modify all Coherence-accessible data over HTTP. Because the flaw carries a scope change, successful exploitation can significantly impact additional products beyond Coherence itself, yielding a CVSS 3.1 score of 9.6. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a high-priority patch item.
Full takeover of Oracle Coherence (an in-memory data grid within Oracle Fusion Middleware) is achievable by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch item.
Denial-of-service with data tampering in Oracle Coherence 15.1.1.0.0 (Fusion Middleware Core) lets an unauthenticated network attacker hang or repeatedly crash the in-memory data grid over TCP, while also gaining limited unauthorized read and write access to a subset of grid-managed data. Rated CVSS 3.1 8.6 by Oracle and described as 'easily exploitable,' the flaw requires no authentication or user interaction. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Remote takeover of Oracle Coherence (a component of Oracle Fusion Middleware) allows an unauthenticated attacker with TCP network access to fully compromise the affected in-memory data grid, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) reflects complete loss of confidentiality, integrity, and availability with no authentication or user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'easily exploitable' framing and full-impact vector make this a high-priority patch across affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Full takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) can be achieved by unauthenticated remote attackers sending crafted HTTP traffic, affecting versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates this CVSS 9.8 with complete confidentiality, integrity, and availability loss, and describes it as 'easily exploitable,' meaning no authentication, user interaction, or special preconditions are required. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Remote unauthenticated compromise of Oracle Coherence (a component of Oracle Fusion Middleware) allows attackers with only network TCP access to fully take over the affected instance, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 9.8 and affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit identified at time of analysis, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) and full confidentiality, integrity, and availability impact make this a high-priority patch item.
Remote takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware allows an unauthenticated attacker with only TCP network access to fully compromise the in-memory data grid, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score is 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the combination of no authentication and full-system takeover makes it a top-priority patch.
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with network access over TCP reaches the Core component, yielding full confidentiality, integrity, and availability compromise (CVSS 9.8). The flaw affects Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 shipped as part of Oracle Fusion Middleware, and is addressed in the Oracle Critical Patch Update of July 2026. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.