CVE-2026-35306: Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars)

Synopsis

This is a critical-severity data exposure and tampering vulnerability in Oracle Coherence 15.1.1.0.0, specifically in its Centralized Third Party Jars component. The vulnerability is reachable over the network via HTTP with no authentication required and no user interaction needed, making it trivially exploitable from any host with network access to the service. Successful exploitation gives an attacker full read access to all data accessible by Oracle Coherence and limited write access to insert, update, or delete some of that data, with a scope change meaning the impact can spill over into adjacent systems beyond Coherence itself. No fix version has been published upstream; HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle ships a patch.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Coherence HTTP endpoint over the network; the service must be exposed to an attacker-controlled host, whether on the internet or internally.

• AuthenticationNot required

  No account or credential of any privilege level is required; the attacker can send malicious requests as an anonymous, unauthenticated caller.

• Victim interactionNot required

  The attack is entirely server-side and requires no action from any user or administrator to trigger.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special race conditions, timing windows, or environmental preconditions beyond network access.

Blast Radius

• Reads all data accessible to Oracle Coherence, including cached application data, session state, and any sensitive records stored or proxied through the cluster.
• Inserts, updates, or deletes a subset of Oracle Coherence accessible data, allowing an attacker to corrupt or manipulate application state.
• Scope change applies, meaning the impact can extend beyond Oracle Coherence itself to other products or services that consume or trust data from the affected cluster.