Critical Unauthenticated RCE Vulnerability in Oracle Coherence (CVE-2026-35307) Puts Enterprise Systems at Risk
Overview
CVE-2026-35307 is a critical remote code execution vulnerability in Oracle Coherence with a CVSS 10.0 score, enabling unauthenticated attackers to fully compromise systems via HTTP. Immediate mitigation is required for organizations using affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0).
Technical Analysis
The flaw resides in Oracle Coherence’s HTTP endpoint handling, allowing attackers to execute arbitrary code without authentication. Exploitation requires sending a crafted request that bypasses standard validation, leading to full system takeover. The vulnerability’s CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) indicates ease of remote exploitation with severe confidentiality, integrity, and availability impacts. Attack scope extends beyond Coherence due to interconnected enterprise architectures.
Enterprise & DIB Impact
Defense Industrial Base (DIB) and enterprise environments relying on Oracle Coherence for distributed computing face imminent risk. Unpatched systems could enable data exfiltration, service disruption, or lateral movement within critical infrastructure. The lack of authentication requirements amplifies exposure for publicly accessible deployments.
Recommended Actions
- Inventory all Oracle Coherence instances and verify version numbers
- Apply patches from Oracle’s Critical Patch Update advisories immediately
- Restrict HTTP access to Coherence endpoints using firewall rules and IP whitelisting
- Monitor network traffic for anomalous HTTP requests to Coherence ports
- Update intrusion detection systems with signatures for known exploitation patterns
Need Help Assessing Your Exposure?
Axiom Cyber Research provides vulnerability assessment, red team operations, and security advisory services to the Defense Industrial Base and regulated sectors.
Schedule a ConsultationFull security advisory on 247alerts.net →