CVE-2026-35307: Oracle Coherence Auth Bypass Vulnerability

CVE-2026-35307 Overview

CVE-2026-35307 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can compromise Oracle Coherence with low attack complexity. The vulnerability carries a maximum CVSS 3.1 base score of 10.0 and includes a scope change, meaning successful exploitation may impact additional products beyond Coherence itself. Successful attacks can result in complete takeover of Oracle Coherence with full compromise of confidentiality, integrity, and availability. Oracle disclosed the issue in the June 2026 Critical Patch Update Security Alert. The flaw is classified under [CWE-284: Improper Access Control].

Critical Impact
Unauthenticated remote attackers can take over Oracle Coherence over HTTP with no user interaction, and the scope change extends impact to additional connected Fusion Middleware products.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0 and 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-06-17 - CVE CVE-2026-35307 published to the National Vulnerability Database
2026-06-17 - Oracle publishes the June 2026 Security Alert
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-35307

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used by Fusion Middleware deployments to provide distributed caching, clustering, and stateful application services. The vulnerability resides in the Core component and is reachable over HTTP. An unauthenticated attacker can send crafted network traffic to a Coherence endpoint and gain full control of the Coherence instance without user interaction.

The scope change indicator means the exploited component breaches its security boundary. An attacker compromising Coherence can pivot to dependent applications and data sources that trust the cluster, including Fusion Middleware tiers, WebLogic domains, and any application using Coherence for session state or caching.

The EPSS model currently rates exploitation probability at 0.473% (37.187 percentile), but this number is expected to climb as Oracle Coherence has a long history of high-impact deserialization and access control flaws actively exploited in the wild.

Root Cause

Oracle classifies the weakness as [CWE-284: Improper Access Control]. The Core component does not adequately enforce authentication or authorization on a network-reachable interface, allowing an unauthenticated client to invoke privileged operations. Oracle has not disclosed the specific request handler or protocol path involved in the public advisory.

Attack Vector

The attack vector is network-based over HTTP. The attacker requires no privileges and no user interaction. Exposed Coherence management endpoints, REST interfaces, and cluster ports reachable from untrusted networks are the primary targets. Internet-exposed Fusion Middleware deployments and flat internal networks where Coherence ports are broadly reachable face the highest risk.

No verified proof-of-concept code is publicly available. Refer to the Oracle Security Alert for vendor guidance and patched build numbers.

Detection Methods for CVE-2026-35307

Indicators of Compromise

Unexpected HTTP requests to Oracle Coherence management or REST endpoints from external or non-administrative source addresses.
New or unusual child processes spawned by Coherence or WebLogic JVMs, including shells, scripting interpreters, or download utilities.
Outbound network connections from Coherence hosts to unrecognized destinations following inbound HTTP traffic to Coherence ports.
Unauthorized modifications to Coherence cluster configuration, cache entries, or deployed serialization filters.

Detection Strategies

Inspect HTTP access logs on Coherence and front-end proxies for anomalous URIs, oversized payloads, or serialized Java object content types.
Hunt for Java process trees where java running Coherence spawns cmd.exe, powershell.exe, /bin/sh, bash, curl, or wget.
Correlate Coherence cluster membership change events with authentication failures and unexpected administrative API calls.

Monitoring Recommendations

Enable verbose HTTP and JMX request logging on all Coherence nodes and forward logs to a central analytics platform.
Baseline normal Coherence cluster traffic, including peer ports and management API usage, and alert on deviations.
Monitor file integrity on Coherence configuration directories, including tangosol-coherence-override.xml and any serialization filter configuration files.

How to Mitigate CVE-2026-35307

Immediate Actions Required

Apply the Oracle June 2026 Critical Patch Update to all Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 deployments without delay.
Inventory all Coherence instances, including embedded deployments within WebLogic, SOA Suite, and custom Fusion Middleware applications.
Remove direct internet exposure of Coherence HTTP, REST, and cluster ports until patching is complete.
Review authentication logs and Coherence audit data for the period preceding patch deployment to identify potential prior exploitation.

Patch Information

Oracle released fixes in the June 2026 Critical Patch Update Security Alert. Administrators should download the bundle patches matching their Coherence and Fusion Middleware versions from My Oracle Support and follow the documented post-installation steps. Full details and patch identifiers are available in the Oracle Security Alert Advisory.

Workarounds

Restrict network access to Coherence ports using host firewalls, network ACLs, and Kubernetes network policies so only trusted application tiers can connect.
Place Coherence REST and management interfaces behind an authenticating reverse proxy that enforces mutual TLS or token-based access.
Configure Coherence Java serialization filters to deny all classes not explicitly required, reducing the impact of deserialization-based exploitation paths.
Disable any Coherence HTTP-based management or extend services that are not required in the deployment.

bash

# Example: restrict Coherence cluster and management ports to a trusted subnet
iptables -A INPUT -p tcp --dport 7574 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
iptables -A INPUT -p tcp --dport 8080 -j DROP

# Enforce a deny-by-default JEP 290 serialization filter for the Coherence JVM
export JAVA_OPTS="$JAVA_OPTS -Djdk.serialFilter=!*"