CVE-2026-35304

Unauthenticated HTTPS Authentication Bypass Allowing Full Oracle Coherence Takeover

Published Jun 16, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Analysis

Technical impact

A critical security flaw in Oracle Coherence allows an unauthenticated attacker to exploit the system over HTTPS, resulting in full takeover of the Coherence service. The vulnerability is classified as an authentication bypass (CWE-306) and can be leveraged to compromise confidentiality, integrity, and availability, producing a CVSS v3.1 base score of 9.8.

Affected Systems

The affected versions are Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0; these releases provide the Oracle Fusion Middleware component Core that is vulnerable.

Risk and Exploitability

The low EPSS score (<1%) indicates that exploitation is unlikely at the time of this analysis, yet the high CVSS score and lack of KEV listing mean the Coherence HTTPS interface is exposed with no user authentication; once the flaw is leveraged, the attacker can achieve full system compromise.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

Oracle Coherence

affected

Version	Status	Constraints
`12.2.1.4.0`	affected	—
`14.1.1.0.0`	affected	—
`14.1.2.0.0`	affected	—
`15.1.1.0.0`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:oracle:coherence:12.2.1.4.0:::::::*
	cpe:2.3:a:oracle:coherence:14.1.1.0.0:::::::*
	cpe:2.3:a:oracle:coherence:14.1.2.0.0:::::::*
	cpe:2.3:a:oracle:coherence:15.1.1.0.0:::::::*

No data.

Vendor Product Versions

Oracle

Coherence

Version	Status	Scheme	Platform
`12.2.1.4.0`	affected	generic	—
`14.1.1.0.0`	affected	generic	—
`14.1.2.0.0`	affected	generic	—
`15.1.1.0.0`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Oracle Coherence to the latest patched release that addresses the authentication bypass flaw
Restrict network access to the Coherence HTTPS endpoints using firewall rules or VPN so that only trusted hosts can reach them
Disable or remove any unused Coherence services or interfaces from exposed networks

Generated by OpenCVE AI on June 18, 2026 at 12:50 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.474% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://www.oracle.com/security-alerts/cspujun2026.html

History

Jun 18, 2026 4:45 AM Title updated View changes

Type	Values Removed	Values Added
Title		Unauthenticated HTTPS Authentication Bypass Allowing Full Oracle Coherence Takeover

Jun 17, 2026 1:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-306
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 16, 2026 8:45 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared		Oracle Oracle coherence
CPEs		cpe:2.3:a:oracle:coherence:12.2.1.4.0:::::::* cpe:2.3:a:oracle:coherence:14.1.1.0.0:::::::* cpe:2.3:a:oracle:coherence:14.1.2.0.0:::::::* cpe:2.3:a:oracle:coherence:15.1.1.0.0:::::::*
Vendors & Products		Oracle Oracle coherence
References		https://www.oracle.com/security-alerts/cspujun2026.html
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`