CVE-2026-35306 is a vulnerability in Oracle Coherence (component: Centralized Third Party Jars) version 15.1.1.0.0 that allows an unauthenticated attacker with network access via HTTP to compromise the system. The vulnerability can result in unauthorized access to all Oracle Coherence accessible data and unauthorized update, insert, or delete operations on some of that data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) reflects a network attack vector with low attack complexity, no privileges or user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among 245 security patches but does not explicitly confirm patch availability or remediation level for this CVE. Oracle advises customers to apply patches promptly and consider network protocol blocking or privilege restrictions as temporary mitigations.

Successful exploitation of CVE-2026-35306 can lead to unauthorized access to critical and all accessible data within Oracle Coherence 15.1.1.0.0, as well as unauthorized modification (update, insert, delete) of some data. This compromises confidentiality and integrity of the affected system. The vulnerability requires no authentication or privileges and can be exploited remotely via HTTP, increasing the risk of widespread impact. There is no reported impact on availability. The vulnerability may also affect additional products due to scope change, potentially broadening the impact beyond Oracle Coherence itself.

Oracle's June 2026 Critical Security Patch Update advisory strongly recommends applying the provided security patches as soon as possible to address this vulnerability. Although the advisory does not explicitly confirm patch availability or remediation level for CVE-2026-35306, customers should monitor Oracle's official patch documentation linked in the advisory for updates. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation (e.g., HTTP access to Oracle Coherence) and by removing unnecessary privileges or access to vulnerable packages from users. These mitigations may affect application functionality and should be tested accordingly.