CVE-2026-35306
Undergoing Analysis Undergoing Analysis - In Progress
Unauthenticated Remote Code Execution in Oracle Coherence

Publication date: 2026-06-17

Last updated on: 2026-06-17

Assigner: Oracle

Description
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Coherence accessible data as well as unauthorized update, insert or delete access to some of Oracle Coherence accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-17
Last Modified
2026-06-17
Generated
2026-06-17
AI Q&A
2026-06-17
EPSS Evaluated
N/A
NVD
CVE-2026-35306
EUVD
EUVD-2026-37432
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
oracle coherence 15.1.1.0.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

The vulnerability allows unauthorized access to critical data and unauthorized modification of some data within Oracle Coherence. Such unauthorized access and data manipulation can lead to violations of data protection regulations and standards that require confidentiality and integrity of sensitive information, such as GDPR and HIPAA.

Because the vulnerability impacts confidentiality and integrity, organizations using the affected Oracle Coherence version may face compliance risks if sensitive personal or health data is exposed or altered without authorization.

Executive Summary

This vulnerability exists in the Oracle Coherence product of Oracle Fusion Middleware, specifically in the Centralized Third Party Jars component. It affects version 15.1.1.0.0. The vulnerability is easily exploitable by an unauthenticated attacker who has network access via HTTP. Successful exploitation allows the attacker to compromise Oracle Coherence, potentially gaining unauthorized access to critical data or complete access to all data accessible through Oracle Coherence.

Impact Analysis

The impact of this vulnerability can be severe. An attacker can gain unauthorized access to critical data or even complete access to all data accessible via Oracle Coherence. Additionally, the attacker may be able to perform unauthorized updates, inserts, or deletions on some of the accessible data. This can lead to data breaches, data corruption, and loss of data integrity.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-35306. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart