CVE-2026-35306: Cohere unauthenticated data

CISO Take

CVE-2026-35306 is a critical unauthenticated network vulnerability in Oracle Coherence 15.1.1.0.0 that allows any attacker with HTTP reach to read all data accessible to the Coherence cluster and make limited writes or deletes — zero credentials required, zero user interaction needed. The scope-change flag (S:C in the CVSS vector) is the detail that elevates this beyond a typical data-exposure bug: a compromised Coherence node can pivot into connected systems, which matters acutely in enterprise AI pipelines where Coherence commonly serves as an in-memory feature store, inference cache, or distributed session layer for LLM API backends. With 653 downstream dependents, an OpenSSF score of 5.2/10, and seven prior CVEs in the same package, this component shows a pattern of risk that warrants architectural scrutiny, not just patching. Apply Oracle's June 2026 CPU immediately; as an interim control, restrict Coherence cluster HTTP ports to trusted network segments via firewall rules and audit whether any AI pipeline services expose this component to broader network zones.

Sources: NVD EPSS OpenSSF ATLAS oracle.com

What is the risk?

Risk is HIGH-CRITICAL in any environment where Oracle Coherence is reachable from untrusted network segments. CVSS 9.3 reflects the worst-case combination: network-exploitable, low complexity, no privileges, no user interaction, and a scope change that extends blast radius to adjacent systems. EPSS at 0.35% (73rd percentile) indicates statistically elevated exploitation likelihood relative to the overall CVE population, even though no public PoC exists today. The third-party JAR component nature of the flaw suggests the root cause may be an embedded dependency vulnerability — historically these take longer for organizations to detect, patch, and validate. AI/ML systems running on Oracle Fusion Middleware stacks are disproportionately exposed if Coherence is used as an inference cache or feature-serving layer without network-level isolation.

How does the attack unfold?

Initial Access

Attacker identifies an Oracle Coherence 15.1.1.0.0 HTTP management endpoint exposed on the network and sends unauthenticated HTTP requests — no credentials, no exploit framework required.

AML.T0049

Data Collection

Attacker enumerates all cache entries via the Coherence REST management API, extracting cached LLM API responses, feature vectors, session tokens, and any AI pipeline data stored in the grid.

AML.T0035

Cache Poisoning

Attacker leverages limited write access (CVSS I:L) to inject adversarially crafted entries into the inference cache, silently corrupting feature data served to downstream AI models.

AML.T0025

Lateral Movement / Impact

Scope-change exploitation allows attacker to pivot from the Coherence management interface into co-located Oracle Fusion Middleware services, escalating access to backend AI databases and orchestration layers.

AML.T0025

Initial Access

Attacker identifies an Oracle Coherence 15.1.1.0.0 HTTP management endpoint exposed on the network and sends unauthenticated HTTP requests — no credentials, no exploit framework required.

AML.T0049

Data Collection

Attacker enumerates all cache entries via the Coherence REST management API, extracting cached LLM API responses, feature vectors, session tokens, and any AI pipeline data stored in the grid.

AML.T0035

Cache Poisoning

Attacker leverages limited write access (CVSS I:L) to inject adversarially crafted entries into the inference cache, silently corrupting feature data served to downstream AI models.

AML.T0025

Lateral Movement / Impact

Scope-change exploitation allows attacker to pivot from the Coherence management interface into co-located Oracle Fusion Middleware services, escalating access to backend AI databases and orchestration layers.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Cohere	pip	—	No patch
396 OpenSSF 5.2 302 dependents Pushed 9d ago 13% patched ~14d to patch Full package profile →

Do you use Cohere? You're affected.

How severe is it?

CVSS 3.1

9.3 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 28% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Changed

C High

I Low

A None

What should I do?

6 steps

PATCH IMMEDIATELY

Apply the Oracle Critical Patch Update for June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) — this is the only confirmed remediation for CVE-2026-35306. No workaround fully substitutes for the patch.
NETWORK ISOLATION

Restrict Coherence cluster ports (default 7574 HTTP management, 7575, cluster ports) to dedicated management VLANs or VPC security groups. Block inbound HTTP to Coherence management interfaces from any untrusted segment.
AUDIT EXPOSURE

Run netstat -tlnp | grep 7574 or equivalent on all Oracle Middleware hosts to identify unintended HTTP listener exposure.
REVIEW THIRD-PARTY JARS: Identify which embedded dependency introduced CWE-284 by reviewing the Oracle patch advisory — if the root cause is a known library (e.g., a Java deserialization or access-control library), check for the same jar in other internal applications.
DETECT ANOMALOUS ACCESS

Alert on unexpected HTTP GET/POST requests to Coherence management endpoints from IPs outside the trusted management range. Coherence logs management API calls — enable and ship these to SIEM.
ASSESS DATA SENSITIVITY

Inventory what data transits Coherence in AI pipelines; if API keys, session tokens, or PII are cached, treat this as a potential data breach until patching is confirmed.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Auth Bypass Data Leakage API Inference Framework AML.T0010.001 - AI Software AML.T0025 - Exfiltration via Cyber Means AML.T0035 - AI Artifact Collection AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk management system — security requirements

ISO 42001

A.6.2 - AI system access control

NIST AI RMF

PROTECT-2.2 - Data and model access controls

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-35306?

CVE-2026-35306 is a critical unauthenticated network vulnerability in Oracle Coherence 15.1.1.0.0 that allows any attacker with HTTP reach to read all data accessible to the Coherence cluster and make limited writes or deletes — zero credentials required, zero user interaction needed. The scope-change flag (S:C in the CVSS vector) is the detail that elevates this beyond a typical data-exposure bug: a compromised Coherence node can pivot into connected systems, which matters acutely in enterprise AI pipelines where Coherence commonly serves as an in-memory feature store, inference cache, or distributed session layer for LLM API backends. With 653 downstream dependents, an OpenSSF score of 5.2/10, and seven prior CVEs in the same package, this component shows a pattern of risk that warrants architectural scrutiny, not just patching. Apply Oracle's June 2026 CPU immediately; as an interim control, restrict Coherence cluster HTTP ports to trusted network segments via firewall rules and audit whether any AI pipeline services expose this component to broader network zones.

Is CVE-2026-35306 actively exploited?

No confirmed active exploitation of CVE-2026-35306 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35306?

1. PATCH IMMEDIATELY: Apply the Oracle Critical Patch Update for June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) — this is the only confirmed remediation for CVE-2026-35306. No workaround fully substitutes for the patch. 2. NETWORK ISOLATION: Restrict Coherence cluster ports (default 7574 HTTP management, 7575, cluster ports) to dedicated management VLANs or VPC security groups. Block inbound HTTP to Coherence management interfaces from any untrusted segment. 3. AUDIT EXPOSURE: Run `netstat -tlnp | grep 7574` or equivalent on all Oracle Middleware hosts to identify unintended HTTP listener exposure. 4. REVIEW THIRD-PARTY JARS: Identify which embedded dependency introduced CWE-284 by reviewing the Oracle patch advisory — if the root cause is a known library (e.g., a Java deserialization or access-control library), check for the same jar in other internal applications. 5. DETECT ANOMALOUS ACCESS: Alert on unexpected HTTP GET/POST requests to Coherence management endpoints from IPs outside the trusted management range. Coherence logs management API calls — enable and ship these to SIEM. 6. ASSESS DATA SENSITIVITY: Inventory what data transits Coherence in AI pipelines; if API keys, session tokens, or PII are cached, treat this as a potential data breach until patching is confirmed.

What systems are affected by CVE-2026-35306?

This vulnerability affects the following AI/ML architecture patterns: Enterprise LLM API backends on Oracle Fusion Middleware, Inference result caching layers, Feature serving pipelines, Distributed session stores for AI applications, Oracle-stack RAG pipelines.

What is the CVSS score for CVE-2026-35306?

CVE-2026-35306 has a CVSS v3.1 base score of 9.3 (CRITICAL). The EPSS exploitation probability is 0.35%.

What is the AI security impact?

Affected AI Architectures

Enterprise LLM API backends on Oracle Fusion MiddlewareInference result caching layersFeature serving pipelinesDistributed session stores for AI applicationsOracle-stack RAG pipelines

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0025 Exfiltration via Cyber Means

AML.T0035 AI Artifact Collection

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: A.6.2

NIST AI RMF: PROTECT-2.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Coherence accessible data as well as unauthorized update, insert or delete access to some of Oracle Coherence accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).

Exploitation Scenario

An adversary with network access to a corporate AI inference platform discovers an Oracle Coherence 15.1.1.0.0 management endpoint exposed on port 7574/HTTP — reachable from the corporate LAN because the Coherence cluster was deployed without firewall restrictions as part of an Oracle Fusion Middleware LLM API backend. Using a simple unauthenticated HTTP GET to the Coherence REST management API (no exploit tooling required — just curl), the attacker enumerates all cache entries, extracting cached LLM API responses containing user queries, partial model outputs with sensitive business data, and transiently cached API credentials used for downstream Oracle AI services. Leveraging the limited write access, the attacker then injects crafted feature-vector entries into the inference cache: future model queries that hit the poisoned cache entries receive adversarially modified feature data, silently skewing model outputs for targeted queries without any alerts firing. The scope-change vector allows the attacker to subsequently move laterally from the Coherence management interface into co-located Oracle Fusion Middleware components, escalating toward backend databases.

Weaknesses (CWE)

CWE-284 Improper Access Control

CWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.