Oracle Coherence CVE-2026-35305

Exploitation requires only network reachability to an Oracle Coherence 15.1.1.0.0 HTTP interface (Coherence*Extend HTTP, REST management, or any service backed by the 'Centralized Third Party Jars' component) on a host running the affected version; no authentication, user interaction, or non-default configuration is required per the CVSS vector AV:N/AC:L/PR:N/UI:N. Realistic limiting factors are deployment-driven rather than configuration-driven: Coherence is typically deployed on internal data-tier networks behind WebLogic or application servers, so internet-exposed instances are relatively rare, and the impact on integrity is limited (I:L) and availability is unaffected (A:N), so the practical attacker outcome is primarily data disclosure plus partial tampering rather than full takeover. Versions other than 15.1.1.0.0 are not listed as affected in the supplied data and would need vendor confirmation before being assumed exploitable.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) is one of the strongest possible risk profiles short of full integrity/availability impact: remote, unauthenticated, low-complexity, no user interaction, and crossing a scope boundary, scoring 9.3. EPSS data was not provided and the vulnerability is not on the CISA KEV list at time of analysis, so there is no public confirmation of active exploitation and no public exploit identified. Two data points warrant explicit caution: the CWE is N/A and only an Oracle CPU advisory link is provided, so technical detail is limited to Oracle's own summary - defenders cannot independently validate the exact attack surface. Given Oracle Fusion Middleware's historical pattern of post-CPU exploitation (e.g., prior Coherence/WebLogic deserialization chains), treat this as a real priority for any internet- or partner-network-exposed Coherence cluster rather than discounting it for lack of EPSS/KEV signal.

An attacker reaches an exposed Oracle Coherence HTTP endpoint over the network without credentials and sends a crafted HTTP request that exercises the vulnerable third-party JAR, bypassing authentication and reading sensitive cached data such as session state, configuration, or business records held in the grid. Because the vulnerability has scope change, the attacker may also pivot into adjacent Fusion Middleware components co-located with the Coherence JVM (e.g., a hosting WebLogic domain) to modify a limited set of records. No public exploit is identified at time of analysis, but the low complexity and unauthenticated profile make weaponization after CPU disclosure plausible.