CVE-2026-35309: Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars)

Synopsis

A critical remote code execution vulnerability affects Oracle Coherence (part of Oracle Fusion Middleware) in the Centralized Third Party Jars component, covering versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw is reachable over HTTP from any network location without credentials or user interaction, placing it at the highest CVSS tier. Successful exploitation results in full takeover of the Oracle Coherence instance, giving an attacker control over confidentiality, integrity, and availability. No upstream fix has been published yet; HarborGuard is tracking the advisory and will surface a patched-image rebuild the moment Oracle ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Coherence HTTP endpoint over the network; no local access or physical proximity is needed.

• AuthenticationNot required

  No credentials of any privilege level are required; the vulnerable endpoint accepts unauthenticated requests.

• Victim interactionNot required

  Exploitation is entirely attacker-driven and requires no action from any user or administrator.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other variable environmental factors.

Blast Radius

• A successful attacker gains the ability to execute arbitrary code within the Oracle Coherence process, achieving full system takeover.
• All data accessible to the Coherence instance, including cached application data and secrets, can be read by the attacker.
• The attacker can write, modify, or delete persisted and in-memory data managed by Coherence, corrupting application state.
• The attacker can crash or permanently disable the Coherence service, causing a denial of service for any application layer that depends on it.