What is the CVSS score of CVE-2026-35309?

CVE-2026-35309 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-35309?

Oracle Coherence (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) contains a critical remote code execution vulnerability affecting all Fusion Middleware deployments with HTTP network…

How to fix or mitigate CVE-2026-35309?

Within 24 hours: Inventory all Oracle Coherence deployments and their network accessibility; isolate affected instances from untrusted networks where operationally feasible. Within 7 days: Implement network-layer access controls (firewall rules, WAF policies) restricting HTTP traffic to Coherence endpoints to known administrative sources only; prepare incident response procedures for potential compromise. Within 30 days: Monitor Oracle security advisories for patch release (expected within 6-12 weeks based on CVSS severity); evaluate whether affected instances can be decommissioned or replaced; if patches remain unavailable, execute business continuity plan for affected services.

Oracle Coherence CVE-2026-35309

EUVD-2026-37435 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor confirms unauthenticated network HTTP exploitation with low complexity and no user interaction, resulting in full product takeover, justifying PR:N/UI:N and C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:38 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Coherence is possible by unauthenticated attackers with HTTP network access to affected Fusion Middleware deployments running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0. The flaw resides in the Centralized Third Party Jars component and carries a critical 9.8 CVSS score with full confidentiality, integrity, and availability impact; no public exploit identified at time of analysis, but the trivial attack profile and Oracle's CPU disclosure pattern make weaponization likely.

Technical ContextAI

Oracle Coherence is an in-memory data grid platform used in Fusion Middleware deployments for distributed caching, computation, and event processing across clustered Java application servers. The vulnerable component, 'Centralized Third Party Jars,' refers to bundled third-party library dependencies shipped with Coherence - historically this packaging has been the source of deserialization and library-level flaws (e.g., prior Coherence CVEs tied to Java serialization in T3/IIOP/HTTP listeners). No CWE is assigned in the source data, but the CVSS profile (network, low complexity, no auth, full CIA impact, scope unchanged) combined with the 'Centralized Third Party Jars' surface is consistent with an unsafe-deserialization or expression-injection class flaw exposed over an HTTP endpoint.

RemediationAI

Apply the Oracle Critical Patch Update for June 2026 as documented at https://www.oracle.com/security-alerts/cspujun2026.html - the advisory ships fixes for all four affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); patch available per vendor advisory, though specific post-patch version strings are not enumerated in the source data and should be confirmed against the CPU patch matrix. If patching cannot be performed immediately, restrict network reachability of Coherence HTTP management and cluster ports (default management REST on 30000/HTTP, Extend proxy listeners, and any custom HTTP endpoints) to trusted management subnets only via firewall ACLs, which will break remote client/admin access from outside the allowlisted range. Where Coherence is fronted by an application server, disable or remove unused HTTP listeners and Centralized Third Party Jars-exposed endpoints, accepting that any client relying on those endpoints will lose connectivity until patched.