CVE-2026-35308: Cohere unauthenticated RCE

CISO Take

Oracle Coherence (versions 12.2.1.4.0–15.1.1.0.0) carries a CVSS 10.0 unauthenticated RCE in its bundled third-party jars component, exploitable over HTTP with zero credentials and zero user interaction — the worst possible exploitation profile on every axis. The CVSS scope change flag (S:C) is the detail that elevates this beyond a single-service incident: a successful exploit cascades beyond the Coherence node into connected systems, threatening AI/ML services — model-serving layers, feature stores, and RAG retrieval caches — that depend on Coherence for distributed data management. With 653 downstream dependents and EPSS placing this in the top 60% of vulnerabilities likely to see real-world exploitation, the risk window is open even without a public exploit or KEV listing. Apply Oracle's June 2026 Critical Patch Update immediately; where patching cannot happen within 24 hours, isolate Coherence HTTP management endpoints at the firewall and audit logs for any unauthenticated access attempts.

Sources: NVD EPSS OpenSSF ATLAS

What is the risk?

Maximum risk. CVSS 10.0 with network vector, low complexity, no privileges required, no user interaction, and scope change means any reachable Oracle Coherence instance is trivially and completely compromisable by an unauthenticated remote attacker. In AI/ML environments, Coherence is commonly deployed as a distributed cache for feature stores, real-time inference result caching, and LLM API response caching — roles where full system compromise enables simultaneous data exfiltration, cache poisoning, and lateral movement. The absence of a public exploit provides a brief window, but EPSS top-60% signals active reconnaissance is plausible, and the low exploitation complexity means weaponization will be rapid once a PoC surfaces.

How does the attack unfold?

Reconnaissance

Adversary scans internet-exposed hosts for Oracle Coherence HTTP management interfaces via port fingerprinting and banner grabbing to identify vulnerable versions.

AML.T0006

Initial Access

A crafted unauthenticated HTTP request exploits the third-party jar access control flaw (CWE-284), achieving remote code execution on the Coherence node with no credentials or user interaction.

AML.T0049

Collection & Lateral Movement

Attacker leverages the compromised Coherence cluster member — trusted by internal segmentation — to read cached AI inference data and pivot to connected ML serving endpoints unreachable externally.

AML.T0025

Impact

Adversary exfiltrates cached LLM API requests and responses, injects poisoned cache entries to corrupt AI inference decisions downstream, or destroys Coherence cluster state to deny AI services.

AML.T0048

Reconnaissance

Adversary scans internet-exposed hosts for Oracle Coherence HTTP management interfaces via port fingerprinting and banner grabbing to identify vulnerable versions.

AML.T0006

Initial Access

A crafted unauthenticated HTTP request exploits the third-party jar access control flaw (CWE-284), achieving remote code execution on the Coherence node with no credentials or user interaction.

AML.T0049

Collection & Lateral Movement

Attacker leverages the compromised Coherence cluster member — trusted by internal segmentation — to read cached AI inference data and pivot to connected ML serving endpoints unreachable externally.

AML.T0025

Impact

Adversary exfiltrates cached LLM API requests and responses, injects poisoned cache entries to corrupt AI inference decisions downstream, or destroys Coherence cluster state to deny AI services.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Cohere	pip	—	No patch
396 OpenSSF 5.2 302 dependents Pushed 9d ago 13% patched ~14d to patch Full package profile →

Do you use Cohere? You're affected.

How severe is it?

CVSS 3.1

10.0 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 39% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Changed

C High

I High

A High

What should I do?

5 steps

Apply Oracle Critical Patch Update (CPU) for June 2026 covering CVE-2026-35308 across all affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) — treat as P0 emergency patching.
As an immediate interim control, firewall all Coherence HTTP management ports (defaults: 7001, 9612) to allow access only from trusted management hosts; Coherence should never have internet-exposed management interfaces.
Inventory which AI/ML services (model servers, feature stores, RAG retrievers, LLM API caching layers) communicate with Coherence nodes and isolate those data paths with micro-segmentation.
Enable Coherence audit logging, ship to SIEM, and alert on any unauthenticated HTTP requests to management endpoints.
Audit transitive exposure across the 653 downstream dependents of the coherence pip package and validate patch status for each.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Supply Chain Framework Inference API AML.T0010.001 - AI Software AML.T0025 - Exfiltration via Cyber Means AML.T0049 - Exploit Public-Facing Application AML.T0072 - Reverse Shell

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

8.4 - AI system requirements — Security

NIST AI RMF

MANAGE 2.2 - AI risk monitoring and treatment

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities LLM04:2025 - Data and Model Poisoning

Frequently Asked Questions

What is CVE-2026-35308?

Oracle Coherence (versions 12.2.1.4.0–15.1.1.0.0) carries a CVSS 10.0 unauthenticated RCE in its bundled third-party jars component, exploitable over HTTP with zero credentials and zero user interaction — the worst possible exploitation profile on every axis. The CVSS scope change flag (S:C) is the detail that elevates this beyond a single-service incident: a successful exploit cascades beyond the Coherence node into connected systems, threatening AI/ML services — model-serving layers, feature stores, and RAG retrieval caches — that depend on Coherence for distributed data management. With 653 downstream dependents and EPSS placing this in the top 60% of vulnerabilities likely to see real-world exploitation, the risk window is open even without a public exploit or KEV listing. Apply Oracle's June 2026 Critical Patch Update immediately; where patching cannot happen within 24 hours, isolate Coherence HTTP management endpoints at the firewall and audit logs for any unauthenticated access attempts.

Is CVE-2026-35308 actively exploited?

No confirmed active exploitation of CVE-2026-35308 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35308?

1. Apply Oracle Critical Patch Update (CPU) for June 2026 covering CVE-2026-35308 across all affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) — treat as P0 emergency patching. 2. As an immediate interim control, firewall all Coherence HTTP management ports (defaults: 7001, 9612) to allow access only from trusted management hosts; Coherence should never have internet-exposed management interfaces. 3. Inventory which AI/ML services (model servers, feature stores, RAG retrievers, LLM API caching layers) communicate with Coherence nodes and isolate those data paths with micro-segmentation. 4. Enable Coherence audit logging, ship to SIEM, and alert on any unauthenticated HTTP requests to management endpoints. 5. Audit transitive exposure across the 653 downstream dependents of the coherence pip package and validate patch status for each.

What systems are affected by CVE-2026-35308?

This vulnerability affects the following AI/ML architecture patterns: Feature stores (enterprise ML), Model serving caches, RAG pipelines, Real-time inference pipelines, LLM API gateway caching layers, Distributed AI data grids.

What is the CVSS score for CVE-2026-35308?

CVE-2026-35308 has a CVSS v3.1 base score of 10.0 (CRITICAL). The EPSS exploitation probability is 0.47%.

What is the AI security impact?

Affected AI Architectures

Feature stores (enterprise ML)Model serving cachesRAG pipelinesReal-time inference pipelinesLLM API gateway caching layersDistributed AI data grids

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0025 Exfiltration via Cyber Means

AML.T0049 Exploit Public-Facing Application

AML.T0072 Reverse Shell

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: 8.4

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM03:2025, LLM04:2025

What are the technical details?

Original Advisory

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Exploitation Scenario

An adversary performs external reconnaissance and identifies an Oracle Coherence management interface exposed over HTTP on a target's AI inference infrastructure — a common misconfiguration in enterprises that deploy Coherence as a distributed cache for LLM API responses or feature store lookups. The attacker sends a specially crafted HTTP request exploiting the improper access control in the bundled third-party jar (CWE-284), bypassing authentication entirely and achieving remote code execution on the Coherence node with no credentials, no user interaction, and no complex preconditions required. Once inside, the attacker reads the in-memory cache to exfiltrate sensitive LLM prompts and responses, injects manipulated entries into the feature store cache to bias real-time model inference downstream, and uses the compromised Coherence cluster member — trusted by internal network segmentation — to pivot laterally to model-serving containers and ML data pipelines unreachable from the internet.

Weaknesses (CWE)

CWE-284 Improper Access Control

CWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.