CVE-2026-35304: Cohere unauthenticated HTTPS

CISO Take

Oracle Coherence versions 12.2.1.4.0 through 15.1.1.0.0 contain a missing authentication flaw (CWE-306) that lets any unauthenticated network attacker fully compromise the cluster over HTTPS — no credentials, no user interaction, no complexity required. With 653 downstream dependents and a CVSS of 9.8, the blast radius extends to every enterprise AI/ML deployment using Coherence as a distributed cache for inference results, session state, or training data; the EPSS of 0.52% (top 60%) reflects a low but non-trivial near-term exploitation probability that will climb once proof-of-concept code surfaces for this trivially-exploitable class of bug. Apply Oracle's June 2026 Critical Patch Update immediately; where patching is delayed, firewall all Coherence HTTPS listener ports to deny access from untrusted segments and enable mutual TLS client certificate authentication as a compensating control.

Sources: NVD EPSS OpenSSF ATLAS

What is the risk?

Critical risk for organizations running Oracle Coherence within or adjacent to AI/ML infrastructure. The attack profile is the worst possible — network-reachable, zero authentication, zero complexity, zero user interaction — meaning any attacker with TCP reach to a Coherence port can attempt exploitation at scale. Full system takeover (C/I/A all High) translates directly to loss of confidentiality for cached model inputs and outputs, integrity loss enabling cache poisoning of AI inference results, and availability loss disrupting dependent AI services. While EPSS is currently low at 0.52% and exploitation is not confirmed in the wild, the trivial difficulty curve makes this a high-priority patching target before weaponized tooling emerges. OpenSSF Scorecard of 5.2/10 and 7 prior CVEs in the same package indicate a historically weaker security posture.

How does the attack unfold?

Reconnaissance

Attacker scans target IP ranges for exposed Oracle Coherence HTTPS listeners, fingerprinting service version from HTTP banners or Oracle advisory disclosure.

AML.T0006

Initial Access

Attacker sends unauthenticated HTTPS management API request exploiting CWE-306 missing authentication, gaining unrestricted access to the Coherence cluster without credentials.

AML.T0049

Collection

Attacker enumerates and reads cached objects in the Coherence data grid, extracting LLM inference inputs, model outputs, session tokens, and any sensitive data stored by dependent AI services.

AML.T0037

Impact

Attacker achieves full cluster takeover: exfiltrates sensitive AI workload data, injects poisoned cache entries to corrupt inference results for downstream users, or crashes the cluster to deny service to AI-dependent pipelines.

AML.T0048

Reconnaissance

Attacker scans target IP ranges for exposed Oracle Coherence HTTPS listeners, fingerprinting service version from HTTP banners or Oracle advisory disclosure.

AML.T0006

Initial Access

Attacker sends unauthenticated HTTPS management API request exploiting CWE-306 missing authentication, gaining unrestricted access to the Coherence cluster without credentials.

AML.T0049

Collection

Attacker enumerates and reads cached objects in the Coherence data grid, extracting LLM inference inputs, model outputs, session tokens, and any sensitive data stored by dependent AI services.

AML.T0037

Impact

Attacker achieves full cluster takeover: exfiltrates sensitive AI workload data, injects poisoned cache entries to corrupt inference results for downstream users, or crashes the cluster to deny service to AI-dependent pipelines.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Cohere	pip	—	No patch
396 OpenSSF 5.2 302 dependents Pushed 9d ago 13% patched ~14d to patch Full package profile →

Do you use Cohere? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 38% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

6 steps

Patch: Apply the Oracle Critical Security Patch Update published June 2026 for all affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0).
Network isolation: Firewall Coherence HTTPS listener ports immediately to only allow connections from explicitly authorized internal subnets — Coherence should never be internet-exposed.
Compensating control: Enable mutual TLS client certificate authentication on all Coherence HTTPS endpoints if immediate patching is not possible.
Inventory: Run 'pip show coherence' and grep application configs across AI/ML workloads to identify all Coherence-dependent services.
Detection: Review Coherence access logs for anomalous unauthenticated request patterns; alert on any management API calls lacking valid client certificates.
Post-patch validation: After upgrade, verify authentication enforcement is active by attempting unauthenticated access and confirming 401/403 responses.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Data Extraction API Inference Framework AML.T0010.001 - AI Software AML.T0020 - Poison Training Data AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.2 - Measures for responsible AI system development

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place and applied to sustain the value of deployed AI systems

OWASP LLM Top 10

LLM04:2025 - Data and Model Poisoning

Frequently Asked Questions

What is CVE-2026-35304?

Oracle Coherence versions 12.2.1.4.0 through 15.1.1.0.0 contain a missing authentication flaw (CWE-306) that lets any unauthenticated network attacker fully compromise the cluster over HTTPS — no credentials, no user interaction, no complexity required. With 653 downstream dependents and a CVSS of 9.8, the blast radius extends to every enterprise AI/ML deployment using Coherence as a distributed cache for inference results, session state, or training data; the EPSS of 0.52% (top 60%) reflects a low but non-trivial near-term exploitation probability that will climb once proof-of-concept code surfaces for this trivially-exploitable class of bug. Apply Oracle's June 2026 Critical Patch Update immediately; where patching is delayed, firewall all Coherence HTTPS listener ports to deny access from untrusted segments and enable mutual TLS client certificate authentication as a compensating control.

Is CVE-2026-35304 actively exploited?

No confirmed active exploitation of CVE-2026-35304 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35304?

1. Patch: Apply the Oracle Critical Security Patch Update published June 2026 for all affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0). 2. Network isolation: Firewall Coherence HTTPS listener ports immediately to only allow connections from explicitly authorized internal subnets — Coherence should never be internet-exposed. 3. Compensating control: Enable mutual TLS client certificate authentication on all Coherence HTTPS endpoints if immediate patching is not possible. 4. Inventory: Run 'pip show coherence' and grep application configs across AI/ML workloads to identify all Coherence-dependent services. 5. Detection: Review Coherence access logs for anomalous unauthenticated request patterns; alert on any management API calls lacking valid client certificates. 6. Post-patch validation: After upgrade, verify authentication enforcement is active by attempting unauthenticated access and confirming 401/403 responses.

What systems are affected by CVE-2026-35304?

This vulnerability affects the following AI/ML architecture patterns: LLM API backends with distributed caching, Model serving infrastructure, AI inference result caching layers, Distributed AI data pipelines, Multi-agent shared context stores.

What is the CVSS score for CVE-2026-35304?

CVE-2026-35304 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.47%.

What is the AI security impact?

Affected AI Architectures

LLM API backends with distributed cachingModel serving infrastructureAI inference result caching layersDistributed AI data pipelinesMulti-agent shared context stores

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0020 Poison Training Data

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.2

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM04:2025

What are the technical details?

Original Advisory

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Exploitation Scenario

An attacker targeting an organization's LLM inference platform scans for Oracle Coherence nodes exposed over HTTPS — a common misconfiguration in cloud environments where security groups are left overly permissive. Exploiting CWE-306, they send a crafted management API request with no authentication headers; Coherence grants full cluster access. The attacker enumerates cached objects and extracts thousands of user query-response pairs stored by the LLM API caching layer, exfiltrating sensitive prompt content and proprietary model outputs. They then inject poisoned cache entries targeting high-frequency query patterns, causing the LLM API to serve attacker-controlled responses to legitimate users without triggering the model at all. Finally, they modify Coherence cluster membership configuration to maintain persistent access, surviving a restart of the application layer.

Weaknesses (CWE)

CWE-306 Missing Authentication for Critical Function

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.