CVE-2026-35308

Critical · CVSS 10.0

Oracle Coherence — Improper Access Control / Unauthenticated RCE via HTTP (CWE-284, Scope Change)

CVSS: 10.0; nvd
EPSS: —
KEV: No
Class: other; CWE-284

Description

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Search profile — drives PoC discovery

Symbols Oracle CoherenceCentralized Third Party Jarscoherence.jarcom.tangosolDefaultCacheServerHttpHelpercom.tangosol.net.CacheFactorycom.oracle.coherence

Keywords CVE-2026-35308Oracle Coherence RCEOracle Coherence unauthenticated HTTP exploitOracle Fusion Middleware Coherence PoCCoherence Centralized Third Party Jars vulnerabilityOracle Coherence takeoverOracle Coherence CVSS 10Oracle Coherence scope change HTTPOracle Coherence 12.2.1.4.0 exploitOracle Coherence 14.1.1.0.0 exploit

Versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0

References

https://www.oracle.com/security-alerts/cspujun2026.html

Status: enriched · ingested 2026-06-19T12:00:04.000Z · profiled 2026-06-19T12:30:04.000Z