CVE-2026-35307
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk37th percentile — higher than 37% of all known CVEs
Summary
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to take control of Oracle Coherence. Affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Risk Assessment
Attacks may significantly impact additional products, increasing the risk for the organization. Successful exploitation can lead to complete takeover of Oracle Coherence, threatening confidentiality, integrity, and availability of data.
Recommendation
It is recommended to update to the latest version of Oracle Coherence and implement appropriate security measures to restrict system access to authorized users.
Original NVD description (English source)
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).