CVE-2026-35306 is a vulnerability in Oracle Coherence 15.1.1.0.0 (part of Oracle Fusion Middleware) involving the Centralized Third Party Jars component. It allows an unauthenticated attacker with network access over HTTP to compromise Oracle Coherence, potentially gaining unauthorized access to all accessible data and the ability to update, insert, or delete some data. The vulnerability affects confidentiality and integrity with a CVSS 3.1 score of 9.3 and has a scope change affecting additional Oracle products. Oracle’s June 2026 Critical Security Patch Update advisory addresses this vulnerability among many others but does not explicitly confirm patch availability for this specific CVE. Oracle strongly recommends applying security patches promptly and suggests network-level mitigations and privilege restrictions as interim risk reduction measures.

Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible via Oracle Coherence, as well as unauthorized modification (update, insert, delete) of some data. The vulnerability impacts confidentiality and integrity severely but does not affect availability. The scope of impact may extend beyond Oracle Coherence to additional Oracle products. The CVSS 3.1 score of 9.3 reflects critical severity with network attack vector, no required privileges or user interaction, and scope change.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this vulnerability. The vendor advisory does not explicitly confirm patch availability for CVE-2026-35306 but advises prompt patching of supported versions. Until patches are applied, risk may be reduced by blocking network protocols required for the attack and removing unnecessary privileges or package access from users. These mitigations may impact application functionality. Customers should monitor Oracle’s advisory for updated patch information and apply official fixes when available.