CVE-2026-35308 is an easily exploitable vulnerability in the Centralized Third Party Jars component of Oracle Coherence within Oracle Fusion Middleware. It allows unauthenticated attackers with network access over HTTP to compromise Oracle Coherence, potentially resulting in full system takeover. The vulnerability affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects a critical vulnerability with network attack vector, no privileges or user interaction required, and complete impact on confidentiality, integrity, and availability. Oracle’s June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 security patches. Oracle strongly recommends applying these patches immediately to prevent exploitation.

Successful exploitation of CVE-2026-35308 can lead to complete compromise of Oracle Coherence, including full confidentiality, integrity, and availability loss. The vulnerability is exploitable remotely without authentication via HTTP, increasing the risk of widespread impact. Additionally, the vulnerability's scope change means it may affect other Oracle products that rely on Oracle Coherence, potentially broadening the impact beyond the initially affected component.

Oracle has released security patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply these patches promptly to remediate the vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges or package access from users. However, these workarounds may disrupt application functionality. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory at https://www.oracle.com/security-alerts/cspujun2026.html.