CVE-2026-35304 is a critical security vulnerability in Oracle Coherence (Oracle Fusion Middleware Core component) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It allows an unauthenticated attacker with network access over HTTPS to compromise the product, potentially resulting in complete takeover. The vulnerability is scored 9.8 on the CVSS 3.1 scale, reflecting high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among 245 patches but does not explicitly confirm patch availability or remediation level for this specific CVE. Oracle strongly advises customers to apply the Critical Security Patch Update without delay and remain on actively supported versions. Workarounds include blocking network protocols required for exploitation and restricting privileges, though these may disrupt normal operations.

Successful exploitation of CVE-2026-35304 can lead to full compromise of Oracle Coherence, impacting confidentiality, integrity, and availability of the affected system. An unauthenticated attacker with network access via HTTPS can exploit this vulnerability, potentially resulting in takeover of the product. This represents a critical risk to organizations using the affected versions of Oracle Coherence.

Oracle recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this vulnerability along with others. The vendor advisory does not explicitly confirm patch availability for CVE-2026-35304 but strongly urges patch application for all addressed vulnerabilities. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges or access to vulnerable packages from users. These mitigations may impact application functionality and should be applied cautiously. Customers should monitor Oracle advisories for updates on patch availability and remediation guidance.