CVE-2026-35306: Oracle Coherence Auth Bypass Vulnerability

CVE-2026-35306 Overview

CVE-2026-35306 is an access control vulnerability in Oracle Coherence, a component of Oracle Fusion Middleware. The flaw resides in the Centralized Third Party Jars component and affects version 15.1.1.0.0. An unauthenticated attacker with network access over HTTP can compromise Oracle Coherence without user interaction. The vulnerability carries a scope change, meaning successful exploitation can affect resources beyond Oracle Coherence itself. Successful attacks can yield complete read access to Oracle Coherence data and partial write access to some accessible data. The weakness is classified under [CWE-284] Improper Access Control.

Critical Impact
Unauthenticated remote attackers can obtain complete access to data managed by Oracle Coherence and modify a subset of that data, with cross-component impact due to scope change.

Affected Products

Oracle Coherence 15.1.1.0.0
Oracle Fusion Middleware (Centralized Third Party Jars component)
Applications and services dependent on Oracle Coherence clustering or caching

Discovery Timeline

2026-06-17 - CVE-2026-35306 published to NVD
2026-06-17 - Oracle Critical Security Update advisory published
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-35306

Vulnerability Analysis

The vulnerability exists in the Centralized Third Party Jars component of Oracle Coherence. Oracle Coherence is an in-memory data grid used for distributed caching and stateful application clustering across Oracle Fusion Middleware deployments. The flaw allows an unauthenticated remote attacker to interact with the affected component over HTTP and bypass intended access controls. Because the vulnerability triggers a scope change, exploitation can affect components and data outside the immediate trust boundary of Oracle Coherence. The result is unauthorized read access to all data the Coherence instance can reach, and unauthorized insert, update, or delete access to a subset of that data. Integrity impact is partial, and availability is not directly affected. The vulnerability does not require any user interaction or prior privileges.

Root Cause

The root cause is improper access control [CWE-284] within the Centralized Third Party Jars component. Authorization checks are insufficient or missing for HTTP-reachable functionality, allowing anonymous callers to invoke operations that should require authenticated, privileged access.

Attack Vector

The attack vector is network-based over HTTP. An attacker only needs reachability to the exposed Coherence HTTP endpoint. The attack complexity is low and no privileges or user interaction are required. Internet-exposed or insufficiently segmented Coherence deployments are at highest risk.

No verified proof-of-concept code is publicly available at the time of writing. Refer to the Oracle Security Alert June 2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-35306

Indicators of Compromise

Unauthenticated HTTP requests to Oracle Coherence management or third-party JAR endpoints from external or unexpected internal sources.
Unusual bulk read operations against Coherence caches, particularly from sessions without prior authentication.
Anomalous insert, update, or delete operations on Coherence-managed data outside of normal application workflows.
Outbound connections from Coherence JVMs to unfamiliar hosts following inbound HTTP requests.

Detection Strategies

Inspect web access logs and reverse proxy logs for HTTP requests targeting Coherence endpoints without valid authentication tokens or session identifiers.
Baseline normal Coherence cache access patterns and alert on deviations in volume, source IP, or operation type.
Correlate Coherence JVM telemetry with network flow data to identify scope-changing behavior reaching adjacent Fusion Middleware components.

Monitoring Recommendations

Enable verbose HTTP and authentication logging on all Coherence nodes and forward logs to a centralized analytics platform.
Monitor Oracle Fusion Middleware audit trails for unexpected configuration changes following HTTP traffic spikes.
Track EPSS movement for CVE-2026-35306, which currently sits at a low exploitation probability but may shift if a public exploit emerges.

How to Mitigate CVE-2026-35306

Immediate Actions Required

Apply the patches published in the Oracle Security Alert June 2026 to all Oracle Coherence 15.1.1.0.0 instances.
Inventory all Coherence deployments, including embedded instances bundled with Fusion Middleware products, and confirm version exposure.
Restrict network reachability of Coherence HTTP endpoints to trusted management networks until patches are applied.
Review authentication and authorization configuration on Coherence REST and management interfaces.

Patch Information

Oracle has released fixes as part of the June 2026 Critical Security Update. Administrators should consult the Oracle Security Alert June 2026 for the exact patch identifiers applicable to their Coherence and Fusion Middleware versions and apply them following Oracle's recommended sequencing.

Workarounds

Place Coherence HTTP endpoints behind an authenticating reverse proxy or web application firewall configured to deny unauthenticated requests.
Apply network segmentation to ensure Coherence cluster ports and management endpoints are not reachable from untrusted networks or the public internet.
Disable HTTP-based management interfaces on Coherence nodes where they are not strictly required for operations.

bash

# Example: restrict Coherence HTTP management port using iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP