Oracle Coherence CVE-2026-35306

Required: network HTTP reachability to an Oracle Coherence 15.1.1.0.0 instance with the Centralized Third Party Jars component in use - typically a Coherence cluster member or a Fusion Middleware host exposing a Coherence HTTP/management interface; no credentials, no user interaction, and no special non-default tunables are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N) and Oracle's 'easily exploitable' wording. Limiting factors: exploitation is constrained to deployments running exactly version 15.1.1.0.0 as listed by Oracle, requires that the relevant Coherence HTTP listener be reachable from the attacker (often only inside an internal Fusion Middleware tier rather than internet-exposed), and the scope-change impact on 'additional products' only materializes where other Fusion Middleware components actually trust this Coherence cluster.

All available signals point to a high-priority issue: CVSS 3.1 base score 9.3 with AV:N/AC:L/PR:N/UI:N indicates remote, unauthenticated, low-complexity exploitation, and the S:C scope flag plus Oracle's own statement that 'attacks may significantly impact additional products' means a successful exploit can pivot trust to other Fusion Middleware components sharing the Coherence tier. EPSS data was not provided in the input, so probabilistic exploitation likelihood cannot be quantified, and the vulnerability is not listed in CISA KEV and no public PoC is referenced - so this is a high-severity, vendor-confirmed issue without yet-public weaponization. Note that C:H but only I:L and A:N implies a primarily data-disclosure flaw with limited tampering and no denial of service, which is somewhat unusual for a 9.3 score and is driven mainly by the scope change; defenders should not downgrade priority on that basis because Coherence typically holds session tokens, cached credentials, and business data whose disclosure alone is severe.

An attacker with network reachability to a Fusion Middleware host running Coherence 15.1.1.0.0 sends crafted HTTP requests to an exposed Coherence endpoint, bypassing authentication and reading cached data - for example user sessions, configuration objects, or business data held in the grid for an adjacent WebLogic application. Because of the scope change, the disclosed data and limited write capability can then be used to influence the behavior of other Fusion Middleware products that trust the Coherence tier, such as forging or modifying session-cached state. No public exploit is referenced in the input, but Oracle's 'easily exploitable, unauthenticated, AC:L' wording implies a straightforward HTTP exchange is sufficient.