CVE-2026-35307: Critical severity Oracle Oracle Coherence vulnerability
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to Oracle Coherence HTTP endpoints to trusted IPs only (firewall/ACLs). Block or deny direct public/Internet access to Coherence HTTP ports to eliminate unauthenticated network access via HTTP.
- Compensating control
Segment and isolate Oracle Coherence instances from other application and platform components (network segmentation/VLANs) to reduce scope and prevent lateral impact to additional products.
- Compensating control
Deploy detection and prevention controls (WAF, IDS/IPS) with rules to detect and block exploit attempts against Oracle Coherence over HTTP and monitor for anomalous HTTP requests.
- Operational
Monitor logs and network traffic for signs of exploitation, perform forensic investigation if indicators are found, and if compromise is suspected rebuild affected Coherence hosts and rotate any credentials or keys that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35307?
CVE-2026-35307 has a critical severity rating of 10.
How do I fix CVE-2026-35307?
To fix CVE-2026-35307, upgrade to the latest version of Oracle Coherence that addresses this vulnerability.
What types of attacks can exploit CVE-2026-35307?
CVE-2026-35307 can be exploited by unauthenticated attackers with network access via HTTP.
Which versions of Oracle Coherence are affected by CVE-2026-35307?
The affected versions of Oracle Coherence are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
What impact does CVE-2026-35307 have on Oracle Coherence?
CVE-2026-35307 allows an attacker to compromise Oracle Coherence, leading to potential unauthorized access and data breach.