CVE-2026-35304: Oracle Coherence RCE Vulnerability

CVE-2026-35304 Overview

CVE-2026-35304 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated remote attacker with network access via HTTPS can fully compromise the affected product. Successful exploitation results in complete takeover of Oracle Coherence, impacting confidentiality, integrity, and availability.

The flaw is classified under CWE-306: Missing Authentication for Critical Function. Oracle disclosed the issue in its June 2026 Critical Patch Update. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

Critical Impact
Unauthenticated network attackers can take over Oracle Coherence instances via HTTPS without user interaction.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-06-17 - CVE-2026-35304 published to NVD
2026-06-17 - Last updated in NVD database
June 2026 - Oracle releases fix in the Critical Patch Update Advisory

Technical Details for CVE-2026-35304

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle Coherence, an in-memory data grid platform used for distributed caching and scalable application state management. According to Oracle's advisory, the flaw is easily exploitable and requires no authentication, no privileges, and no user interaction. An attacker reaching the Coherence service over HTTPS can compromise the product and gain full control.

The weakness is categorized as CWE-306: Missing Authentication for Critical Function. This indicates that an exposed function performing a security-relevant action does not verify the caller's identity. Because Coherence often runs as part of larger Fusion Middleware deployments, compromise of a node can expose cached application data and provide a pivot point into adjacent services.

Root Cause

The root cause is the absence of authentication checks on a network-reachable function within the Core component. Any client that can negotiate an HTTPS session with the Coherence endpoint can invoke the affected functionality and trigger the takeover condition. No credential, token, or session prerequisite is enforced.

Attack Vector

Exploitation occurs across the network over HTTPS. The attacker requires only reachability to the Coherence service port. Because the scope is unchanged but the confidentiality, integrity, and availability impacts are all high, a successful request grants the attacker control equivalent to the Coherence process itself. Oracle has not published exploit details, and there are no public proof-of-concept exploits at the time of writing. The current EPSS probability is 0.473%.

Detection Methods for CVE-2026-35304

Indicators of Compromise

Unexpected HTTPS connections to Oracle Coherence cluster ports from untrusted networks or non-application hosts.
Newly spawned child processes from the Coherence JVM, including shells, scripting interpreters, or curl/wget invocations.
Outbound network connections initiated by the Coherence process to unfamiliar external IPs or domains.
Modifications to Coherence configuration files, cache stores, or deployment artifacts outside of change windows.

Detection Strategies

Inventory all Fusion Middleware hosts and identify Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Monitor the Coherence JVM for anomalous process lineage, class loading from unexpected paths, and unusual thread activity.
Inspect HTTPS request logs at load balancers and reverse proxies for requests to Coherence management or extend endpoints from outside trusted ranges.
Correlate authentication-less access patterns against known administrative endpoints to surface probing attempts.

Monitoring Recommendations

Forward Coherence, WebLogic, and host telemetry to a centralized analytics platform and alert on deviations from baseline.
Enable network flow logging on segments hosting Coherence clusters and review traffic to and from cluster member ports.
Track file integrity on Coherence binaries, configuration, and deployment directories.

How to Mitigate CVE-2026-35304

Immediate Actions Required

Apply the Oracle June 2026 Critical Patch Update for Coherence to all instances of 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Restrict network exposure of Coherence cluster and management ports to trusted application tiers only.
Audit recent access logs and process activity on Coherence hosts for signs of pre-patch exploitation.
Rotate credentials, keys, and secrets accessible to the Coherence service after patching.

Patch Information

Oracle addressed CVE-2026-35304 in the June 2026 Critical Patch Update. Refer to the Oracle Security Alert for the full list of patches and applicable platform notes. Apply the fix using standard OPatch procedures and validate cluster health after deployment.

Workarounds

Place Coherence endpoints behind a network policy that allows traffic only from authenticated application servers.
Terminate HTTPS at a reverse proxy that enforces mutual TLS or client certificate validation in front of Coherence.
Disable or remove unused Coherence Extend or management listeners until patches can be applied.

bash

# Example: restrict Coherence ports with iptables to a trusted application subnet
iptables -A INPUT -p tcp --dport 9099 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP