CVE-2026-35309: Cohere unauthenticated RCE

CISO Take

Oracle Coherence versions 12.2.1.4.0 through 15.1.1.0.0 contain a critical improper access control flaw (CWE-284) in centralized third-party JAR dependencies that allows any unauthenticated attacker with HTTP network access to achieve full system takeover — no credentials, no user interaction, no complexity required. With 653 downstream dependents and an OpenSSF Scorecard of only 5.2/10, AI/ML pipelines that rely on Coherence as a distributed feature store, inference cache, or session state layer face complete data-tier compromise including exfiltration of cached API keys, model inputs/outputs, and feature vectors. Although the current EPSS sits at 0.52%, the zero-friction exploitation profile and CVSS 9.8 score mean weaponization is trivial once a public proof-of-concept surfaces — historically that window closes within days for Oracle CPU-patched vulnerabilities. Apply Oracle's June 2026 Critical Security Patch Update immediately and enforce network-level access controls restricting Coherence ports to trusted hosts pending full remediation.

Sources: NVD EPSS OpenSSF ATLAS oracle.com

What is the risk?

CRITICAL. The AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector represents the worst-case exploitability profile with zero prerequisites. AI/ML environments that embed Coherence as a distributed in-memory cache for feature stores, model output caching, or pipeline session state are directly exposed. The supply-chain nature of the flaw — in third-party JARs bundled within Coherence — elevates risk beyond the raw EPSS score, as patching is contingent on Oracle's release cycle. Seven other CVEs already present in the same package, combined with a below-average OpenSSF Scorecard (5.2/10), indicate systemic dependency hygiene issues that compound long-term exposure.

How does the attack unfold?

Initial Access

Attacker identifies a network-exposed Oracle Coherence HTTP management endpoint and sends a crafted unauthenticated HTTP request exploiting CWE-284 improper access control in bundled third-party JARs.

AML.T0049

Exploitation

Access control bypass grants attacker full control of the Coherence cluster node, achieving the 'takeover' impact described in the CVE with no credentials or user interaction required.

AML.T0049

Collection

Attacker reads distributed in-memory cache contents, extracting AI API credentials, feature vectors, cached model inference inputs/outputs, and session tokens stored by upstream AI pipeline components.

AML.T0085

Impact

Exfiltrated credentials enable lateral movement into AI services; injected cache entries poison downstream model inference responses; availability disruption halts latency-sensitive AI pipelines dependent on Coherence lookups.

AML.T0025

Initial Access

Attacker identifies a network-exposed Oracle Coherence HTTP management endpoint and sends a crafted unauthenticated HTTP request exploiting CWE-284 improper access control in bundled third-party JARs.

AML.T0049

Exploitation

Access control bypass grants attacker full control of the Coherence cluster node, achieving the 'takeover' impact described in the CVE with no credentials or user interaction required.

AML.T0049

Collection

Attacker reads distributed in-memory cache contents, extracting AI API credentials, feature vectors, cached model inference inputs/outputs, and session tokens stored by upstream AI pipeline components.

AML.T0085

Impact

Exfiltrated credentials enable lateral movement into AI services; injected cache entries poison downstream model inference responses; availability disruption halts latency-sensitive AI pipelines dependent on Coherence lookups.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Cohere	pip	—	No patch
396 OpenSSF 5.2 302 dependents Pushed 9d ago 13% patched ~14d to patch Full package profile →

Do you use Cohere? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 38% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Patch immediately: Apply Oracle Critical Security Patch Update (CPU) June 2026 — https://www.oracle.com/security-alerts/cspujun2026.html — targeting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. 2) Network segmentation (immediate workaround): Enforce firewall ACLs restricting Coherence cluster and management ports (default 7001, 9200, 1521) to trusted internal CIDR ranges only — eliminate any internet-facing exposure. 3) Dependency audit: Run 'pip show coherence' and scan all requirements.txt and pyproject.toml files for direct or transitive Coherence Python client usage across AI/ML projects. 4) Detection: Monitor Coherence HTTP access logs for anomalous unauthenticated requests; alert on unexpected cluster membership changes or configuration modifications. 5) Credential rotation: Treat any credentials, API keys, or tokens that may have been accessible via Coherence cache as potentially compromised; rotate proactively for high-value AI service credentials.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Data Extraction Framework API Inference AML.T0010.001 - AI Software AML.T0025 - Exfiltration via Cyber Means AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk management system

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MANAGE 2.2 - Treatments, responses, and recovery

OWASP LLM Top 10

LLM03 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-35309?

Oracle Coherence versions 12.2.1.4.0 through 15.1.1.0.0 contain a critical improper access control flaw (CWE-284) in centralized third-party JAR dependencies that allows any unauthenticated attacker with HTTP network access to achieve full system takeover — no credentials, no user interaction, no complexity required. With 653 downstream dependents and an OpenSSF Scorecard of only 5.2/10, AI/ML pipelines that rely on Coherence as a distributed feature store, inference cache, or session state layer face complete data-tier compromise including exfiltration of cached API keys, model inputs/outputs, and feature vectors. Although the current EPSS sits at 0.52%, the zero-friction exploitation profile and CVSS 9.8 score mean weaponization is trivial once a public proof-of-concept surfaces — historically that window closes within days for Oracle CPU-patched vulnerabilities. Apply Oracle's June 2026 Critical Security Patch Update immediately and enforce network-level access controls restricting Coherence ports to trusted hosts pending full remediation.

Is CVE-2026-35309 actively exploited?

No confirmed active exploitation of CVE-2026-35309 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35309?

1) Patch immediately: Apply Oracle Critical Security Patch Update (CPU) June 2026 — https://www.oracle.com/security-alerts/cspujun2026.html — targeting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. 2) Network segmentation (immediate workaround): Enforce firewall ACLs restricting Coherence cluster and management ports (default 7001, 9200, 1521) to trusted internal CIDR ranges only — eliminate any internet-facing exposure. 3) Dependency audit: Run 'pip show coherence' and scan all requirements.txt and pyproject.toml files for direct or transitive Coherence Python client usage across AI/ML projects. 4) Detection: Monitor Coherence HTTP access logs for anomalous unauthenticated requests; alert on unexpected cluster membership changes or configuration modifications. 5) Credential rotation: Treat any credentials, API keys, or tokens that may have been accessible via Coherence cache as potentially compromised; rotate proactively for high-value AI service credentials.

What systems are affected by CVE-2026-35309?

This vulnerability affects the following AI/ML architecture patterns: Feature stores backed by Oracle Coherence, Model serving with distributed inference caching, AI pipeline orchestration with Coherence session state, RAG pipelines using Coherence as document or embedding cache, Agent frameworks storing tool-execution context in distributed data grids.

What is the CVSS score for CVE-2026-35309?

CVE-2026-35309 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.47%.

What is the AI security impact?

Affected AI Architectures

Feature stores backed by Oracle CoherenceModel serving with distributed inference cachingAI pipeline orchestration with Coherence session stateRAG pipelines using Coherence as document or embedding cacheAgent frameworks storing tool-execution context in distributed data grids

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0025 Exfiltration via Cyber Means

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Exploitation Scenario

An adversary targeting an enterprise AI platform that uses Oracle Coherence as a distributed feature store scans for exposed Coherence HTTP management endpoints on port 7001. Exploiting the CWE-284 access control bypass in the bundled third-party JARs, they send a single crafted unauthenticated HTTP request that bypasses access controls and achieves remote code execution on the Coherence node. The attacker immediately dumps the in-memory cache, extracting cached LLM API keys (Anthropic, OpenAI) stored as session tokens, proprietary training feature vectors, and recent inference inputs and outputs. Using the compromised Coherence node as a pivot, they inject manipulated cache entries to poison downstream model inference responses, then establish persistence via a reverse shell before Oracle's monitoring detects anomalous cluster behavior.

Weaknesses (CWE)

CWE-284 Improper Access Control

CWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.