CVE-2026-35307: Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core)

Synopsis

A critical unauthenticated remote code execution vulnerability affects the Core component of Oracle Coherence (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0) in Oracle Fusion Middleware. The flaw is reachable over the network via HTTP with no credentials required and no user interaction needed, and it carries a scope-change rating meaning a successful attack can break out of the directly targeted component and affect other systems. Successful exploitation results in full takeover of the Oracle Coherence instance, giving an attacker read, write, and denial-of-service control. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Coherence HTTP endpoint over the network; no local or physical access is needed, making any internet- or intranet-exposed instance directly at risk.

• AuthenticationNot required

  No credentials of any kind are required; an anonymous attacker with network access can send a malicious HTTP request without first obtaining an account.

• Victim interactionNot required

  The attack is fully server-side and completes without any action from a user or administrator on the target system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and repeatable with no race conditions, special memory layout requirements, or other environmental preconditions to satisfy.

Blast Radius

• A successful attacker achieves full takeover of the Oracle Coherence instance, reading all data held in the distributed cache including session tokens, application state, and any sensitive records stored by connected applications.
• The attacker can write or delete arbitrary cache entries, corrupting application data and causing downstream services that depend on Coherence to behave incorrectly or serve tampered content.
• The attacker can crash or indefinitely disrupt the Coherence service, causing denial of availability for all applications that rely on it for data distribution or coordination.
• Because the CVSS scope is marked as changed, the attacker can leverage the compromised Coherence node to pivot and affect other products or services running in the same environment beyond Coherence itself.