Oracle Coherence CVE-2026-35310

Required: network HTTP reachability to an Oracle Coherence node running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 with the 'Core' HTTP-facing listener (e.g. Coherence REST, management, or Coherence*Extend HTTP proxy) bound and reachable from the attacker's network position. No authentication, no user interaction, and no special non-default configuration are needed per CVSS AV:N/AC:L/PR:N/UI:N and Oracle's 'easily exploitable' classification. Limiting factors in practice: Coherence is typically deployed on internal application tiers rather than internet-exposed, so exploitation usually requires prior access to an internal segment or a misconfigured DMZ/management port exposure; hosts whose Coherence HTTP endpoints are firewalled off or disabled are not reachable.

Every available signal points to high real-world risk: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H means a remote, unauthenticated attacker can reach the vulnerable code over the network with low complexity and obtain full CIA impact, and Oracle itself classifies the issue as 'easily exploitable' resulting in product 'takeover.' No EPSS score, SSVC decision, KEV listing, or public POC is provided in the input, so exploitation status is currently 'no public exploit identified at time of analysis' rather than confirmed in-the-wild use. Coherence is rarely exposed to the open internet but is heavily used inside enterprise middleware tiers, so the realistic threat is internal lateral movement and attacks from compromised DMZ hosts; absence of a CWE and any technical write-up means the precise root cause is inferred, not confirmed.

An attacker with network reachability to a Coherence HTTP listener - for example via a compromised internal host, a misconfigured DMZ, or an exposed management port - sends a single crafted HTTP request to the Core component and obtains code execution or full administrative control of the Coherence node without any credentials or user interaction. From a single compromised Coherence member the attacker can pivot to other cluster nodes and the WebLogic/Fusion Middleware stack hosting them, accessing cached session data, application state, and backend integrations. No public exploit identified at time of analysis, but the AC:L/PR:N/UI:N profile means weaponization is expected to be straightforward once technical details are published.