CVE-2026-35310: Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core)

Synopsis

A critical unauthenticated remote takeover vulnerability exists in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw is reachable over HTTP from any network location and requires no authentication or user interaction, derived from the CVSS vector AV:N/AC:L/PR:N/UI:N. Successful exploitation gives an attacker full control of the Oracle Coherence instance, including complete read, write, and availability impact. No fix version has been published by Oracle; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Coherence HTTP service over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No credentials or account of any privilege level are required to trigger the vulnerability.

• Victim interactionNot required

  The attack is fully server-side and completes without any action from a logged-in user or administrator.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable with no race conditions or special environmental factors required (AC:L).

Blast Radius

• A successful attacker achieves full takeover of the Oracle Coherence instance, gaining the ability to read all data managed by the cluster, including cached application data and any secrets or session material stored there.
• The attacker can write or delete arbitrary data within the Coherence data grid, corrupting application state or injecting malicious payloads consumed by downstream services.
• The attacker can crash or render the Coherence service unavailable, disrupting any application that depends on the cluster for caching or distributed computation.
• Because Coherence often acts as a shared data tier across multiple application services, a takeover can serve as a lateral-movement pivot into connected backend systems.