CVE-2026-35309: Critical severity Oracle Oracle Coherence vulnerability
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If feasible, disable Oracle Coherence HTTP endpoints/listeners to remove network HTTP exposure to the product.
Oracle Coherence HTTP access / HTTP listener = disabled - Compensating control
Restrict network access to Oracle Coherence HTTP ports to only trusted management IPs via external controls (firewall, ACL, VPN, or WAF). Block or filter HTTP access from untrusted networks.
- Operational
Isolate affected Oracle Coherence instances from untrusted networks (or remove them from public network access) until a vendor-provided fix or patch is available and applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35309?
CVE-2026-35309 has a critical severity rating of 9.8.
How do I fix CVE-2026-35309?
To mitigate CVE-2026-35309, update to the latest version of Oracle Coherence that addresses the vulnerability.
What products are affected by CVE-2026-35309?
CVE-2026-35309 affects Oracle Coherence in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Can CVE-2026-35309 be exploited remotely?
Yes, CVE-2026-35309 is easily exploitable by unauthenticated attackers with network access.
What type of impact does CVE-2026-35309 have?
CVE-2026-35309 can lead to a compromise of confidentiality, integrity, and availability.