CVE-2026-35308

Undergoing Analysis Undergoing Analysis - In Progress

Remote Code Execution in Oracle Coherence

Publication date: 2026-06-17

Last updated on: 2026-06-19

Assigner: Oracle

Description

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-17

Last Modified

2026-06-19

Generated

2026-07-07

AI Q&A

2026-06-18

EPSS Evaluated

2026-07-06

NVD

CVE-2026-35308

EUVD

EUVD-2026-37434

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	coherence	12.2.1.4.0
oracle	coherence	14.1.1.0.0
oracle	coherence	14.1.2.0.0
oracle	coherence	15.1.1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Compliance Impact

The vulnerability in Oracle Coherence allows an unauthenticated attacker to fully compromise the system, resulting in a complete takeover with high impact on confidentiality, integrity, and availability. Such a compromise could lead to unauthorized access to sensitive data, disruption of services, and data integrity issues.

Given these impacts, organizations using affected versions of Oracle Coherence may face challenges in maintaining compliance with standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data, ensuring data integrity, and maintaining availability of critical systems.

However, the provided information does not explicitly describe the direct effects on compliance or specific regulatory requirements.

Executive Summary

This vulnerability exists in the Oracle Coherence product of Oracle Fusion Middleware, specifically in the Centralized Third Party Jars component. It affects several supported versions including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

The vulnerability is easily exploitable by an unauthenticated attacker who has network access via HTTP. Successful exploitation can lead to a complete compromise or takeover of Oracle Coherence.

The impact is severe, affecting confidentiality, integrity, and availability, with a CVSS 3.1 base score of 10.0, indicating a critical security issue.

Impact Analysis

If exploited, this vulnerability can allow an attacker to take over the Oracle Coherence system without any authentication.

Such a takeover can lead to significant impacts on confidentiality, integrity, and availability of the affected system.

Additionally, because the vulnerability may affect other products beyond Oracle Coherence (scope change), the overall impact could be broader, potentially compromising multiple systems.

Hi! I’m here to help you understand CVE-2026-35308. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70