CVE-2026-35305: Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars)

Synopsis

An unauthenticated network-exploitable vulnerability exists in Oracle Coherence 15.1.1.0.0 (Fusion Middleware, Centralized Third Party Jars component), reachable over HTTP without any credentials or user interaction. The flaw carries a CVSS 3.1 score of 9.3 (Critical) and has a scope-change characteristic, meaning successful exploitation can spill over into systems beyond Oracle Coherence itself. Exploitation gives an attacker full read access to all data Oracle Coherence can reach and limited write access, including unauthorized insert, update, and delete operations. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Coherence HTTP endpoint over the network; no physical or local access is needed.

• AuthenticationNot required

  No credentials of any privilege level are required; the vulnerability is exploitable by any unauthenticated party with network access.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; exploitation is fully attacker-driven.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental preparation.

Blast Radius

• Reads all data accessible to Oracle Coherence, including cached objects, session tokens, and any sensitive records stored or passing through the cluster.
• Writes unauthorized inserts, updates, or deletes to a subset of Oracle Coherence accessible data, allowing limited data tampering or poisoning of cached state.
• Because the CVSS scope is changed, compromise can extend beyond Oracle Coherence itself, potentially affecting other Fusion Middleware components or downstream systems that trust Coherence-provided data.