CVE-2026-35305: Cohere unauth data exfiltration

CISO Take

Oracle Coherence 15.1.1.0.0 contains a critical unauthenticated access control failure (CWE-284) in its bundled third-party JAR components, allowing any network-adjacent attacker to issue a plain HTTP request — no credentials, no user interaction — and obtain full read access to all Coherence-managed data plus limited write capability, earning a CVSS 9.3 with a scope-change flag that extends blast radius beyond the immediate cluster. With 653 downstream dependents and a 73rd-percentile EPSS rating, the exploitation surface is broad and weaponization probability is above average even without a public exploit today. In AI pipeline contexts, Coherence frequently underpins distributed caching for LLM API response caches, feature stores, and RAG document chunks — all of which would be fully exposed. Patch immediately to the fixed release in Oracle's June 2026 Critical Patch Update; in the interim, firewall all Coherence HTTP management and proxy ports to trusted internal ranges and audit cluster exposure.

Sources: NVD EPSS OpenSSF ATLAS oracle.com

What is the risk?

Critical risk rating. The combination of network-accessible attack vector, low complexity, zero authentication requirement, and zero user interaction places this in the highest exploitability tier. The CVSS scope-change indicator (S:C) means a compromised Coherence node can be leveraged to pivot into adjacent data services. EPSS at the 73rd percentile signals above-average likelihood of exploitation relative to the full CVE population; the absolute score (0.35%) is moderate but the trivial exploitation mechanics mean weaponized tooling could emerge rapidly. No CISA KEV listing and no public exploit currently provide a narrow remediation window. OpenSSF scorecard of 5.2/10 indicates immature supply chain hygiene, consistent with the vulnerable third-party JAR component root cause.

How does the attack unfold?

Network Reconnaissance

Adversary scans for Oracle Coherence HTTP management and proxy ports exposed to untrusted networks, identifying version 15.1.1.0.0 instances via banner or error response fingerprinting.

AML.T0006

Exploitation

Unauthenticated HTTP request exploits CWE-284 access control flaw in a bundled third-party JAR, bypassing all authentication controls and gaining unrestricted data access.

AML.T0049

Data Collection

Attacker enumerates and dumps all distributed cache partitions, extracting cached LLM responses, embedding vectors, feature store snapshots, and AI pipeline intermediate outputs.

AML.T0036

Exfiltration and Cache Poisoning

Exfiltrated data is transferred to adversary infrastructure; limited write access is exploited to inject manipulated cache entries, corrupting downstream AI inference results without triggering re-computation.

AML.T0025

Network Reconnaissance

Adversary scans for Oracle Coherence HTTP management and proxy ports exposed to untrusted networks, identifying version 15.1.1.0.0 instances via banner or error response fingerprinting.

AML.T0006

Exploitation

Unauthenticated HTTP request exploits CWE-284 access control flaw in a bundled third-party JAR, bypassing all authentication controls and gaining unrestricted data access.

AML.T0049

Data Collection

Attacker enumerates and dumps all distributed cache partitions, extracting cached LLM responses, embedding vectors, feature store snapshots, and AI pipeline intermediate outputs.

AML.T0036

Exfiltration and Cache Poisoning

Exfiltrated data is transferred to adversary infrastructure; limited write access is exploited to inject manipulated cache entries, corrupting downstream AI inference results without triggering re-computation.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Cohere	pip	—	No patch
396 OpenSSF 5.2 296 dependents Pushed 9d ago 13% patched ~14d to patch Full package profile →

Do you use Cohere? You're affected.

How severe is it?

CVSS 3.1

9.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Changed

C High

I Low

A None

What should I do?

6 steps

Apply Oracle's June 2026 Critical Patch Update immediately — upgrade Coherence 15.1.1.0.0 to the patched version specified at oracle.com/security-alerts/cspujun2026.html.
Until patching is complete, restrict all Coherence HTTP management endpoints and extend proxy ports to explicitly trusted internal CIDR ranges via host-based or network firewall ACLs; disable HTTP-accessible cluster ports entirely if not operationally required.
Audit the full Coherence cluster topology for any nodes with HTTP ports reachable from untrusted networks; treat any such exposure as confirmed breach for data classification purposes.
If Coherence is used as an AI pipeline cache, rotate API keys, LLM provider credentials, and service account tokens whose associated response data may have transited Coherence.
Monitor Coherence HTTP access logs for anomalous query volumes, unexpected cache key enumeration patterns, or write operations from unfamiliar source IPs as indicators of active exploitation.
Validate that the bundled third-party JARs are not independently deployed elsewhere in the environment.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Auth Bypass API Framework AML.T0010.001 - AI Software AML.T0025 - Exfiltration via Cyber Means AML.T0036 - Data from Information Repositories AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.3 - Information security controls for AI systems

NIST AI RMF

MANAGE 2.4 - Residual risks to individuals and communities are managed

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-35305?

Oracle Coherence 15.1.1.0.0 contains a critical unauthenticated access control failure (CWE-284) in its bundled third-party JAR components, allowing any network-adjacent attacker to issue a plain HTTP request — no credentials, no user interaction — and obtain full read access to all Coherence-managed data plus limited write capability, earning a CVSS 9.3 with a scope-change flag that extends blast radius beyond the immediate cluster. With 653 downstream dependents and a 73rd-percentile EPSS rating, the exploitation surface is broad and weaponization probability is above average even without a public exploit today. In AI pipeline contexts, Coherence frequently underpins distributed caching for LLM API response caches, feature stores, and RAG document chunks — all of which would be fully exposed. Patch immediately to the fixed release in Oracle's June 2026 Critical Patch Update; in the interim, firewall all Coherence HTTP management and proxy ports to trusted internal ranges and audit cluster exposure.

Is CVE-2026-35305 actively exploited?

No confirmed active exploitation of CVE-2026-35305 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35305?

1. Apply Oracle's June 2026 Critical Patch Update immediately — upgrade Coherence 15.1.1.0.0 to the patched version specified at oracle.com/security-alerts/cspujun2026.html. 2. Until patching is complete, restrict all Coherence HTTP management endpoints and extend proxy ports to explicitly trusted internal CIDR ranges via host-based or network firewall ACLs; disable HTTP-accessible cluster ports entirely if not operationally required. 3. Audit the full Coherence cluster topology for any nodes with HTTP ports reachable from untrusted networks; treat any such exposure as confirmed breach for data classification purposes. 4. If Coherence is used as an AI pipeline cache, rotate API keys, LLM provider credentials, and service account tokens whose associated response data may have transited Coherence. 5. Monitor Coherence HTTP access logs for anomalous query volumes, unexpected cache key enumeration patterns, or write operations from unfamiliar source IPs as indicators of active exploitation. 6. Validate that the bundled third-party JARs are not independently deployed elsewhere in the environment.

What systems are affected by CVE-2026-35305?

This vulnerability affects the following AI/ML architecture patterns: AI inference caching layers, RAG document caches, Feature stores, Enterprise AI middleware, Distributed model output caches, LLM API response caches.

What is the CVSS score for CVE-2026-35305?

CVE-2026-35305 has a CVSS v3.1 base score of 9.3 (CRITICAL). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

AI inference caching layersRAG document cachesFeature storesEnterprise AI middlewareDistributed model output cachesLLM API response caches

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0025 Exfiltration via Cyber Means

AML.T0036 Data from Information Repositories

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

NIST AI RMF: MANAGE 2.4

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Coherence accessible data as well as unauthorized update, insert or delete access to some of Oracle Coherence accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).

Exploitation Scenario

An adversary conducting OSINT against an enterprise AI inference platform identifies an Oracle Coherence 15.1.1.0.0 management HTTP endpoint exposed on a non-standard port — a common oversight in containerized deployments where network segmentation is inconsistently applied. Using no credentials, the attacker sends a crafted HTTP request that exploits the CWE-284 access control flaw in a vulnerable bundled third-party JAR, receiving a full serialized dump of all distributed cache partitions. The cache contains: proprietary system prompts cached from the LLM API integration, customer PII embedded in RAG chunk caches, and feature store vectors used by the fraud detection model. In a second pass, the attacker exploits the limited write capability to inject subtly modified cache entries for high-value customer segments, causing the AI application to serve adversary-influenced model outputs without triggering any re-inference or anomaly detection. The entire attack requires no authentication, no malware deployment, and generates log noise indistinguishable from legitimate Coherence cluster traffic in a default logging configuration.

Weaknesses (CWE)

CWE-284 Improper Access Control

CWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.