CVE-2026-35308: Oracle Coherence RCE Vulnerability

CVE-2026-35308 Overview

CVE-2026-35308 is a critical vulnerability in Oracle Coherence, a component of Oracle Fusion Middleware. The flaw resides in the Centralized Third Party Jars component and allows an unauthenticated remote attacker to compromise Oracle Coherence over HTTP. Affected releases include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability carries a maximum CVSS 3.1 base score and includes a scope change, meaning successful exploitation can impact components beyond Oracle Coherence itself. Oracle published the issue in its June 2026 Security Alert.

Critical Impact
Unauthenticated attackers with HTTP network access can take over Oracle Coherence and pivot to additional Fusion Middleware components due to the scope change.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-06-17 - CVE-2026-35308 published to NVD
2026-06-17 - Oracle releases security alert and patches via Oracle Security Alert June 2026
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-35308

Vulnerability Analysis

The vulnerability affects the Centralized Third Party Jars component of Oracle Coherence, an in-memory data grid used to scale clustered Java applications. An unauthenticated attacker can reach the vulnerable code path over HTTP and trigger conditions that result in full product takeover. The flaw is classified under [CWE-284] (Improper Access Control), indicating that protections governing trusted operations are not enforced for remote callers. The scope change in the CVSS vector reflects that exploitation crosses a security boundary, allowing impact to extend beyond the Coherence process to other Fusion Middleware components that share trust or runtime context.

Root Cause

The root cause is improper access control on functionality exposed through bundled third-party libraries. The vulnerable code path accepts requests without verifying the caller's privileges, enabling untrusted HTTP clients to invoke privileged operations. Oracle has not published deeper technical specifics in the security alert.

Attack Vector

An attacker sends crafted HTTP requests to a network-reachable Oracle Coherence instance. No authentication, user interaction, or prior foothold is required. Because attack complexity is low and the attack vector is network-based, internet-exposed deployments are at immediate risk. Verified exploitation code is not publicly available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. EPSS data indicates a probability of 0.473%.

No verified proof-of-concept code is available. Refer to the Oracle Security Alert June 2026 for vendor-provided detail.

Detection Methods for CVE-2026-35308

Indicators of Compromise

Unexpected HTTP requests to Oracle Coherence management or cluster endpoints from untrusted sources.
New or unusual Java processes, child processes, or outbound connections originating from the Coherence JVM.
Unexpected file writes under Coherence installation directories or temporary jar staging paths.
Authentication or authorization failures followed by successful privileged operations on Coherence nodes.

Detection Strategies

Inspect HTTP access logs on Coherence and fronting reverse proxies for anomalous URIs targeting management or third-party jar handlers.
Correlate JVM process telemetry with network connections to identify post-exploitation command execution.
Apply behavioral identification on Coherence hosts to surface child process spawns from java that deviate from baseline.

Monitoring Recommendations

Enable verbose audit logging on Coherence and forward to a centralized SIEM for retention and correlation.
Alert on outbound connections from Coherence hosts to non-approved destinations, including pastebin-like services and unknown IPs.
Monitor for new local accounts, scheduled tasks, or service installations on systems running Coherence.

How to Mitigate CVE-2026-35308

Immediate Actions Required

Apply the patches published in the Oracle Security Alert June 2026 to all affected Coherence versions without delay.
Inventory all Oracle Fusion Middleware deployments and identify any Coherence instances exposed to untrusted networks.
Restrict inbound HTTP access to Coherence management interfaces using network ACLs or a reverse proxy with authentication.
Review logs for any prior unauthenticated HTTP activity targeting Coherence endpoints.

Patch Information

Oracle has released fixed builds for all affected versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Patch details and download links are available in the Oracle Security Alert June 2026. Apply patches in test environments before production rollout and validate cluster stability after upgrade.

Workarounds

Block HTTP access to Coherence ports from untrusted networks at the perimeter firewall and host firewall.
Place Coherence behind an authenticating reverse proxy that rejects anonymous requests to management endpoints.
Segment Coherence clusters into isolated network zones to limit blast radius from scope-changing exploitation.

bash

# Example: restrict Coherence HTTP access to trusted management subnet only
iptables -A INPUT -p tcp --dport 8080 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP