What is the CVSS score of CVE-2026-35310?

CVE-2026-35310 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-35310?

Oracle Coherence (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0) contains a critical vulnerability allowing unauthenticated remote attackers to fully compromise exposed instances via…

How to fix or mitigate CVE-2026-35310?

Within 24 hours: Identify all Oracle Coherence deployments in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and their network exposure; implement firewall rules immediately restricting HTTP access to Coherence clusters to trusted internal networks only. Within 7 days: Complete asset inventory of affected instances and document their business criticality; contact Oracle support for patched version availability and upgrade timeline; evaluate air-gapping or decommissioning unpatched systems. Within 30 days: Apply vendor patch to all instances upon release; verify all Coherence instances are protected by network segmentation or restricted access controls.

Oracle Coherence CVE-2026-35310

EUVD-2026-37436 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated network HTTP exploitation is easy and yields full product takeover, so AV:N, AC:L, PR:N, UI:N with C:H/I:H/A:H and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:39 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Coherence (Fusion Middleware component) is possible by unauthenticated network attackers reaching the HTTP interface, per Oracle's June 2026 Critical Patch Update. Affected versions span 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, with a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) indicating full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, but the trivial attack complexity and unauthenticated network reach make this a top-priority patch for any exposed Coherence cluster.

Technical ContextAI

Oracle Coherence is an in-memory data grid / distributed caching platform widely embedded in Fusion Middleware and WebLogic stacks for low-latency state sharing, session replication, and clustered application caching. The advisory names the 'Core' component and an HTTP attack vector, which in Coherence deployments typically corresponds to management/REST endpoints, the Coherence*Extend HTTP proxy, or the Coherence REST/management gateways used for cluster control and cache access. CWE is not assigned in the input, but the 'takeover' outcome combined with prior Coherence CVE history (notably deserialization classes such as CWE-502) is consistent with an unsafe-deserialization or unauthenticated request-handling flaw in a Core HTTP listener; this should be confirmed once Oracle's detailed advisory or third-party analysis is published.

RemediationAI

Apply Oracle's June 2026 Critical Patch Update (cspujun2026) for Oracle Coherence on each affected branch (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) following the patch matrix and prerequisites in https://www.oracle.com/security-alerts/cspujun2026.html; exact post-patch build numbers are listed in that advisory and should be cited verbatim from Oracle rather than inferred. As compensating controls until patching completes, restrict network access to Coherence cluster, management, and Coherence*Extend HTTP/REST ports to a dedicated management VLAN or jump-host CIDR via firewall/security groups (side effect: breaks ad-hoc developer access and any cross-zone clients), disable or unbind the Coherence REST and management HTTP endpoints if they are not required (side effect: loss of remote monitoring/management tooling that depends on them), and enforce TLS plus authentication on Coherence*Extend and management channels per Oracle's secure configuration guide (side effect: client reconfiguration and possible latency overhead).