CVE-2026-35310: Oracle Coherence RCE Vulnerability

CVE-2026-35310 Overview

CVE-2026-35310 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw allows an unauthenticated remote attacker to compromise the affected instance over HTTP. Oracle disclosed the issue in its June 2026 Critical Patch Update.

Successful exploitation results in full takeover of Oracle Coherence, impacting confidentiality, integrity, and availability. The vulnerability requires no user interaction and no privileges, making it attractive to opportunistic attackers scanning exposed middleware. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

Critical Impact
An unauthenticated network attacker can take over Oracle Coherence, gaining control of cached data, cluster nodes, and dependent application logic.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-06-17 - CVE-2026-35310 published to the National Vulnerability Database (NVD)
2026-06-17 - Oracle releases security patch via the June 2026 Critical Patch Update
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-35310

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used to scale stateful applications across distributed clusters. The Core component handles cluster membership, request routing, and serialized object exchange between nodes and clients.

The vulnerability exposes the Core component to unauthenticated HTTP requests that can compromise the service. Oracle categorizes the issue as an improper access control weakness [CWE-284]. An attacker reaching the Coherence HTTP endpoint can manipulate component behavior without supplying credentials.

The impact extends beyond a single process. Coherence clusters share state, so taking over one node provides a pivot into cached application data and any system that trusts the grid. Production deployments often hold session data, financial records, and authentication tokens.

Root Cause

The root cause is improper access control [CWE-284] in the Core component's HTTP-accessible functionality. The service does not adequately restrict who can invoke privileged operations, allowing an unauthenticated caller to reach code paths that should require authentication and authorization. Oracle has not published low-level technical details beyond the Critical Patch Update advisory.

Attack Vector

The attack vector is the network. An attacker sends crafted HTTP traffic to an exposed Oracle Coherence instance, requiring no prior account, token, or user interaction. Internet-exposed Coherence deployments are at immediate risk, and internal exposure is exploitable by any attacker with a foothold on the same network segment. Refer to the Oracle Security Alert for vendor-supplied technical guidance.

Detection Methods for CVE-2026-35310

Indicators of Compromise

Unexpected HTTP requests to Oracle Coherence management or extend endpoints from untrusted sources.
New or modified cache entries, cluster members, or MBeans appearing without a corresponding change ticket.
Coherence JVM processes spawning shells, scripting interpreters, or outbound connections to unfamiliar hosts.
Authentication and audit logs showing administrative actions without a matching authenticated session.

Detection Strategies

Inspect Coherence HTTP access logs for anomalous URIs, unusual user agents, or bursts of requests from a single source.
Correlate JVM process telemetry with network flows to identify Coherence nodes initiating outbound connections.
Hunt for child processes of the Coherence JVM, which should rarely execute external binaries in normal operation.
Baseline cluster membership and alert when new nodes join outside of approved deployment windows.

Monitoring Recommendations

Forward Coherence, WebLogic, and host logs to a centralized analytics platform with retention sufficient for incident response.
Monitor egress from middleware tiers and alert on connections to non-allowlisted destinations.
Track CPU, memory, and thread anomalies on Coherence JVMs, which can indicate exploitation or post-exploitation activity.
Validate that patch deployment status is reported by configuration management and visible in monitoring dashboards.

How to Mitigate CVE-2026-35310

Immediate Actions Required

Apply the June 2026 Oracle Critical Patch Update to all affected Coherence versions without delay.
Inventory all Coherence deployments, including embedded usage within WebLogic and custom applications, to confirm coverage.
Remove direct internet exposure of Coherence HTTP endpoints and restrict access to trusted management networks.
Review HTTP access logs and cluster audit data for signs of prior exploitation before patching.

Patch Information

Oracle released fixes for CVE-2026-35310 in the June 2026 Critical Patch Update. Patches are available for Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Refer to the Oracle Security Alert for the patch matrix and post-installation steps.

Workarounds

Place Coherence HTTP endpoints behind an authenticating reverse proxy or web application firewall that blocks unauthenticated access until patches land.
Apply network ACLs and firewall rules to restrict Coherence ports to known application servers and administrative hosts.
Disable any non-essential HTTP interfaces on Coherence nodes if patching must be deferred.
Rotate credentials, tokens, and secrets stored in Coherence caches if compromise cannot be ruled out.

bash

# Example: restrict Coherence HTTP management port with iptables
# Replace <mgmt_subnet> and <port> with your environment values
iptables -A INPUT -p tcp --dport <port> -s <mgmt_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport <port> -j DROP