CVE-2026-35305 Overview
CVE-2026-35305 is an improper access control vulnerability [CWE-284] in the Oracle Coherence product of Oracle Fusion Middleware. The flaw resides in the Centralized Third Party Jars component and affects version 15.1.1.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Coherence without user interaction. The vulnerability carries a scope change, meaning successful exploitation can impact additional products beyond Oracle Coherence itself. Oracle disclosed the issue in the June 2026 Critical Patch Update.
Critical Impact
Remote unauthenticated attackers can gain unauthorized access to all Oracle Coherence accessible data and modify a subset of that data over HTTP.
Affected Products
- Oracle Coherence 15.1.1.0.0
- Oracle Fusion Middleware deployments embedding the affected Coherence release
- Downstream applications relying on Coherence clustering and caching services
Discovery Timeline
- 2026-06-17 - CVE-2026-35305 published to NVD
- 2026-06-17 - Last updated in NVD database
- June 2026 - Oracle releases fix via the Oracle Critical Patch Update Advisory
Technical Details for CVE-2026-35305
Vulnerability Analysis
The vulnerability resides in the Centralized Third Party Jars component of Oracle Coherence. Coherence is an in-memory data grid used to share state across clustered Java applications. The flaw enables an unauthenticated attacker to reach Coherence over HTTP and abuse missing or insufficient access control checks. Because the vulnerability involves a scope change, the attacker can affect resources beyond the Coherence component itself. Confidentiality impact is rated High, meaning all Coherence-accessible data can be exfiltrated. Integrity impact is rated Low, allowing limited unauthorized modification, insertion, or deletion of data. Availability is not affected.
Root Cause
The root cause is improper access control [CWE-284] in HTTP-accessible functionality exposed by the Centralized Third Party Jars component. Authorization checks are missing or insufficient on operations that should require authenticated, privileged callers. As a result, requests reaching the listener execute against sensitive Coherence operations without identity validation.
Attack Vector
Exploitation requires only network reachability to the HTTP interface exposed by Oracle Coherence. No credentials, privileges, or user interaction are required. Attack complexity is low, which means the attack does not depend on race conditions or environmental preconditions. Oracle has not reported public exploitation, and no public proof-of-concept is currently available. The vulnerability mechanism is described in prose only because no verified code samples have been published. Refer to the Oracle Security Alert for vendor-supplied technical details.
Detection Methods for CVE-2026-35305
Indicators of Compromise
- Unexpected inbound HTTP requests to Coherence management or extend ports from untrusted sources.
- Anomalous read access patterns against cached datasets, including bulk enumeration of cache entries.
- New or modified entries in Coherence caches that do not correlate with legitimate application writes.
- Outbound connections from Coherence JVMs to attacker-controlled hosts following inbound HTTP activity.
Detection Strategies
- Inspect HTTP access logs on Coherence and fronting reverse proxies for unauthenticated requests to administrative or third-party JAR endpoints.
- Correlate WebLogic and Coherence audit events with network telemetry to identify cross-component scope changes.
- Alert on Coherence JVM process behavior that deviates from baseline, such as spawning child processes or loading unexpected classes.
Monitoring Recommendations
- Forward Coherence, WebLogic, and host telemetry into a centralized analytics platform for cross-source correlation.
- Monitor for queries originating from non-application IP ranges against Coherence ports.
- Track configuration and JAR file changes under the Coherence installation directory using file integrity monitoring.
How to Mitigate CVE-2026-35305
Immediate Actions Required
- Apply the Oracle Critical Patch Update from June 2026 to all affected Oracle Coherence 15.1.1.0.0 deployments.
- Restrict network access to Coherence HTTP listeners so only trusted application tiers can reach them.
- Inventory all Coherence instances across Fusion Middleware estates, including embedded usages within WebLogic clusters.
- Review HTTP and Coherence logs for signs of unauthenticated access since the affected version was deployed.
Patch Information
Oracle addressed CVE-2026-35305 in the June 2026 Critical Patch Update. Administrators should download and apply the relevant patch bundle for Oracle Coherence 15.1.1.0.0 as documented in the Oracle Security Alert. Patches must be applied to every Coherence node in a cluster to prevent inconsistent versions.
Workarounds
- Place Coherence HTTP endpoints behind an authenticating reverse proxy that enforces mutual TLS or strong identity checks.
- Use host-based and network firewalls to limit Coherence ports to specific application server subnets.
- Disable any unused Coherence HTTP services and management interfaces until patching is complete.
- Rotate credentials and tokens accessible from Coherence-managed data if unauthorized access cannot be ruled out.
# Configuration example: restrict Coherence HTTP listener exposure with iptables
# Allow application tier only, drop all other inbound traffic to Coherence HTTP port
iptables -A INPUT -p tcp --dport 8080 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
