CVE-2026-35310 is a critical security vulnerability in Oracle Coherence, a component of Oracle Fusion Middleware. It affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Coherence, potentially resulting in full system takeover. The CVSS 3.1 score is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network exploitable with low attack complexity and no privileges or user interaction required, causing high confidentiality, integrity, and availability impacts. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not explicitly state patch availability or remediation level for this specific issue. Oracle strongly urges customers to apply the Critical Security Patch Update without delay. Workarounds include blocking network protocols required for exploitation or removing unnecessary privileges, though these may disrupt normal operations.

Successful exploitation of CVE-2026-35310 allows an unauthenticated attacker with network access via HTTP to fully compromise Oracle Coherence, leading to complete takeover of the affected system. This impacts confidentiality, integrity, and availability at a high level, as indicated by the CVSS score of 9.8. There are no known exploits in the wild at this time. The vulnerability affects multiple supported versions of Oracle Coherence, potentially exposing many deployments if unpatched.

Oracle's June 2026 Critical Security Patch Update advisory strongly recommends applying the provided security patches as soon as possible to address this vulnerability. Although the advisory does not explicitly confirm patch availability for CVE-2026-35310, it is included in the update, implying patches are available or forthcoming. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users, but these measures may impact application functionality. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.