CVE-2026-35307: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Coherence. in Oracle Corporation Oracle Coherence
CVE-2026-35307 is a critical vulnerability in Oracle Coherence, part of Oracle Fusion Middleware. It allows an unauthenticated attacker with network access via HTTP to fully compromise Oracle Coherence, potentially leading to complete takeover. The vulnerability affects specific versions of Oracle Coherence and may impact additional Oracle products due to scope change. The CVSS 3.1 base score is 10.0, indicating maximum severity with high confidentiality, integrity, and availability impacts. Oracle has released a Critical Security Patch Update in June 2026 addressing this and many other vulnerabilities. Customers are strongly advised to apply the provided patches promptly. Until patched, risk reduction may be possible by blocking required network protocols or restricting privileges, though these mitigations may affect functionality.
AI Analysis
Technical Summary
CVE-2026-35307 is a critical security vulnerability in Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw allows an unauthenticated attacker with network access over HTTP to compromise Oracle Coherence, potentially resulting in full takeover of the product. The vulnerability also has a scope change, meaning exploitation could significantly impact other Oracle products. The CVSS 3.1 score is 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating network attack vector, low attack complexity, no privileges or user interaction required, and critical impacts on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 other patches. Oracle strongly recommends applying these patches immediately. Workarounds include blocking network protocols used by the attack and removing unnecessary privileges, though these may disrupt normal operations.
Potential Impact
Successful exploitation of this vulnerability allows an unauthenticated remote attacker to fully compromise Oracle Coherence, leading to complete loss of confidentiality, integrity, and availability of the affected system. Due to scope change, other Oracle products integrated with or dependent on Oracle Coherence may also be significantly impacted. The critical CVSS score of 10.0 reflects the severe potential damage from exploitation.
Mitigation Recommendations
Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the provided security patches without delay to remediate the issue. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges or access to vulnerable packages from users. However, these mitigations may impact application functionality. Oracle strongly recommends remaining on actively supported versions and promptly applying all security patches as detailed in the June 2026 Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspujun2026.html.
CVE-2026-35307: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Coherence. in Oracle Corporation Oracle Coherence
Description
CVE-2026-35307 is a critical vulnerability in Oracle Coherence, part of Oracle Fusion Middleware. It allows an unauthenticated attacker with network access via HTTP to fully compromise Oracle Coherence, potentially leading to complete takeover. The vulnerability affects specific versions of Oracle Coherence and may impact additional Oracle products due to scope change. The CVSS 3.1 base score is 10.0, indicating maximum severity with high confidentiality, integrity, and availability impacts. Oracle has released a Critical Security Patch Update in June 2026 addressing this and many other vulnerabilities. Customers are strongly advised to apply the provided patches promptly. Until patched, risk reduction may be possible by blocking required network protocols or restricting privileges, though these mitigations may affect functionality.
CVSS v3.1
Score 10.0critical
Affected software
pkg:maven/com.oracle.coherence/coherenceRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-35307 is a critical security vulnerability in Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw allows an unauthenticated attacker with network access over HTTP to compromise Oracle Coherence, potentially resulting in full takeover of the product. The vulnerability also has a scope change, meaning exploitation could significantly impact other Oracle products. The CVSS 3.1 score is 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating network attack vector, low attack complexity, no privileges or user interaction required, and critical impacts on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 other patches. Oracle strongly recommends applying these patches immediately. Workarounds include blocking network protocols used by the attack and removing unnecessary privileges, though these may disrupt normal operations.
Potential Impact
Successful exploitation of this vulnerability allows an unauthenticated remote attacker to fully compromise Oracle Coherence, leading to complete loss of confidentiality, integrity, and availability of the affected system. Due to scope change, other Oracle products integrated with or dependent on Oracle Coherence may also be significantly impacted. The critical CVSS score of 10.0 reflects the severe potential damage from exploitation.
Mitigation Recommendations
Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the provided security patches without delay to remediate the issue. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges or access to vulnerable packages from users. However, these mitigations may impact application functionality. Oracle strongly recommends remaining on actively supported versions and promptly applying all security patches as detailed in the June 2026 Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspujun2026.html.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-04-01T20:03:40.837Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cspujun2026.html","vendor":"Oracle"}]
Threat ID: 6a31b5fe0b89be68882654cc
Added to database: 6/16/2026, 8:45:50 PM
Last enriched: 6/16/2026, 11:47:08 PM
Last updated: 6/17/2026, 4:59:34 AM
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.