CVE-2026-35304: Critical severity Oracle Oracle Coherence vulnerability
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable Oracle Coherence HTTPS listeners or reconfigure them so they are not exposed to untrusted networks. If HTTPS access is required, bind the listener to internal interfaces only and do not expose it to the public internet.
Oracle Coherence HTTPS listener / external access = disabled or limited to internal interfaces - Compensating control
Restrict network access to Oracle Coherence HTTPS ports and management interfaces using firewall rules or ACLs so only trusted IPs and internal networks can connect.
- Compensating control
Place Oracle Coherence behind a VPN or web application firewall (WAF) and require authenticated, trusted network access for clients and administrators to prevent unauthenticated internet access over HTTPS.
- Operational
If Oracle Coherence instances have been exposed to untrusted networks, assume possible compromise: isolate affected hosts from the network, perform incident response and forensic investigation, and remediate compromised systems before returning them to service.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35304?
CVE-2026-35304 has a critical severity rating of 9.8.
How do I fix CVE-2026-35304?
To fix CVE-2026-35304, update Oracle Coherence to the latest version available.
What impact does CVE-2026-35304 have on Oracle Coherence?
CVE-2026-35304 allows an unauthenticated attacker with network access to compromise Oracle Coherence.
Which versions of Oracle Coherence are affected by CVE-2026-35304?
The affected versions of Oracle Coherence include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Is CVE-2026-35304 easily exploitable?
Yes, CVE-2026-35304 is considered easily exploitable over HTTPS.