CVE-2026-35309 Overview
CVE-2026-35309 is a critical vulnerability in the Oracle Coherence product of Oracle Fusion Middleware, specifically affecting the Centralized Third Party Jars component. The flaw allows an unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful exploitation results in full takeover of the affected instance, impacting confidentiality, integrity, and availability.
The vulnerability affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle classified the issue under CWE-284: Improper Access Control.
Critical Impact
Unauthenticated remote attackers can take over Oracle Coherence instances over HTTP without user interaction, leading to full compromise of in-memory data grids and any application relying on them.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0
Discovery Timeline
- 2026-06-17 - CVE-2026-35309 published to NVD
- 2026-06-17 - Last updated in NVD database
- June 2026 - Oracle publishes Critical Security Patch Update advisory
Technical Details for CVE-2026-35309
Vulnerability Analysis
The vulnerability resides in the Centralized Third Party Jars component of Oracle Coherence, the in-memory data grid used across Oracle Fusion Middleware deployments. An unauthenticated attacker with network reachability to the Coherence HTTP interface can trigger the flaw without credentials or user interaction.
Oracle classifies the issue as Improper Access Control [CWE-284]. The advisory describes the attack as easily exploitable, indicating no specialized environmental conditions are required. Successful exploitation results in complete takeover of Oracle Coherence, with high impact across confidentiality, integrity, and availability.
Because Coherence frequently caches sensitive application state and brokers data between WebLogic, middleware tiers, and downstream services, a compromised node provides a foothold for lateral movement across the Fusion Middleware stack.
Root Cause
The root cause is improper access control within the Centralized Third Party Jars component. Oracle does not publish exploitation specifics, but the CWE-284 classification points to missing or insufficient authorization checks on a network-reachable code path that should be restricted to authenticated administrators.
Attack Vector
The attack vector is HTTP over the network. An attacker sends crafted requests to an exposed Coherence endpoint and obtains control over the service without authenticating. No user interaction is required, and the attacker does not need prior privileges on the target.
The vulnerability mechanism is described in prose only because no verified public proof-of-concept code has been released. Refer to the Oracle Critical Security Patch Update for June 2026 for vendor-supplied details.
Detection Methods for CVE-2026-35309
Indicators of Compromise
- Unexpected HTTP requests targeting Coherence management or REST endpoints from untrusted networks.
- New or unknown Java classes, JAR files, or serialized objects loaded by the Coherence JVM.
- Outbound network connections from Coherence nodes to attacker-controlled infrastructure.
- Anomalous child processes spawned by the Coherence or WebLogic process tree.
Detection Strategies
- Inventory all Oracle Coherence deployments and compare installed versions against 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
- Inspect web application firewall and reverse proxy logs for unauthenticated requests to Coherence HTTP paths.
- Hunt for Java deserialization patterns and reflective class loading in JVM and application logs.
Monitoring Recommendations
- Forward Coherence, WebLogic, and host telemetry into a centralized SIEM for correlation against process and network baselines.
- Alert on file integrity changes to Coherence lib/ directories and any centralized third-party JAR repositories.
- Monitor for new listening ports or shells launched under the Coherence service account.
How to Mitigate CVE-2026-35309
Immediate Actions Required
- Apply the Oracle Critical Patch Update released in June 2026 to all affected Coherence versions without delay.
- Restrict network access to Coherence HTTP endpoints to trusted management networks using firewall and segmentation controls.
- Audit Coherence instances for unauthorized JARs, configuration changes, or accounts created since the advisory date.
Patch Information
Oracle has released fixes for CVE-2026-35309 as part of the June 2026 Critical Patch Update. Administrators should review the Oracle Security Alert advisory for the specific patch identifiers corresponding to each supported version and apply them following Oracle's documented upgrade procedures.
Workarounds
- Block external access to Coherence HTTP listeners at the network edge until patching completes.
- Disable or remove unused Coherence REST and management endpoints in coherence-cache-config.xml and related configuration files.
- Enforce mutual TLS and authentication on any reverse proxy fronting Coherence services.
# Example: restrict Coherence HTTP listener to localhost via firewall
iptables -A INPUT -p tcp --dport 8080 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
