CVE-2026-35310: Cohere unauthenticated HTTP full

CISO Take

Oracle Coherence carries a critical access control flaw (CWE-284, CVSS 9.8) that lets any unauthenticated network attacker fully compromise the service via a single HTTP request — no credentials, no user interaction, no complexity barrier. With 653 downstream dependents and EPSS placing this in the top 60% of exploitation likelihood, the blast radius across enterprise Oracle stacks is substantial; AI/ML deployments using Coherence as a distributed cache or state grid for LLM inference are fully exposed, including all cached prompts, responses, and feature data. There is no public exploit yet and it has not reached CISA KEV, but the trivial attack profile (AV:N/AC:L/PR:N/UI:N) means exploitation is a script away once a PoC drops. Apply Oracle's June 2026 Critical Patch Update immediately across all affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); if patching cannot happen immediately, firewall Coherence HTTP management ports to trusted application hosts only as a compensating control.

Sources: NVD EPSS OpenSSF ATLAS

What is the risk?

Critical risk. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is a worst-case profile: network-reachable, zero prerequisites, full CIA impact. OpenSSF Scorecard of 5.2/10 signals moderate supply chain hygiene risk for the package ecosystem. EPSS of 0.52% in the top 60th percentile is non-trivial for infrastructure software and will climb once Oracle CPU advisories are widely digested. AI-serving environments built on Oracle infrastructure — particularly those using Coherence as a distributed inference cache or session store — face complete data exposure and arbitrary write access into their data grid.

How does the attack unfold?

Discovery

Attacker scans for Oracle Coherence instances with exposed HTTP management ports using Shodan, masscan, or internal network enumeration.

AML.T0006

Initial Access

Attacker sends a crafted unauthenticated HTTP request exploiting the CWE-284 access control bypass, achieving full compromise of the Coherence service.

AML.T0049

Data Collection

Attacker reads all data resident in the Coherence grid: cached LLM prompts and responses, user session context, feature vectors, and any credentials stored as cache entries.

AML.T0037

Impact

Attacker injects poisoned data into the grid to corrupt downstream AI inference inputs, exfiltrates AI artifacts and user data, or pivots through the compromised node to reach connected model-serving and vector database infrastructure.

AML.T0025

Discovery

Attacker scans for Oracle Coherence instances with exposed HTTP management ports using Shodan, masscan, or internal network enumeration.

AML.T0006

Initial Access

Attacker sends a crafted unauthenticated HTTP request exploiting the CWE-284 access control bypass, achieving full compromise of the Coherence service.

AML.T0049

Data Collection

Attacker reads all data resident in the Coherence grid: cached LLM prompts and responses, user session context, feature vectors, and any credentials stored as cache entries.

AML.T0037

Impact

Attacker injects poisoned data into the grid to corrupt downstream AI inference inputs, exfiltrates AI artifacts and user data, or pivots through the compromised node to reach connected model-serving and vector database infrastructure.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Cohere	pip	—	No patch
396 OpenSSF 5.2 296 dependents Pushed 9d ago 13% patched ~14d to patch Full package profile →

Do you use Cohere? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 39% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

5 steps

Patch: Apply Oracle Critical Patch Update June 2026 — fixed versions are available for all affected branches (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0). Check https://www.oracle.com/security-alerts/cspujun2026.html for exact patch IDs.
Network isolation: Block external access to Oracle Coherence HTTP ports (default 7574, management console 30000) at the perimeter and between untrusted network segments immediately.
Inventory: Run an internal scan for Coherence HTTP endpoints reachable without authentication — exposed management interfaces are the primary attack surface.
Detect: Enable HTTP request logging on all Coherence nodes and alert on unexpected source IPs or unauthenticated access patterns to the management API.
No software workaround exists that fully substitutes for patching — network restriction is the only interim compensating control.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Data Extraction API Inference Framework AML.T0006 - Active Scanning AML.T0025 - Exfiltration via Cyber Means AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk management system

ISO 42001

8.7 - Information security for AI systems

NIST AI RMF

MANAGE-2.4 - Residual risks are managed to acceptable levels

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-35310?

Oracle Coherence carries a critical access control flaw (CWE-284, CVSS 9.8) that lets any unauthenticated network attacker fully compromise the service via a single HTTP request — no credentials, no user interaction, no complexity barrier. With 653 downstream dependents and EPSS placing this in the top 60% of exploitation likelihood, the blast radius across enterprise Oracle stacks is substantial; AI/ML deployments using Coherence as a distributed cache or state grid for LLM inference are fully exposed, including all cached prompts, responses, and feature data. There is no public exploit yet and it has not reached CISA KEV, but the trivial attack profile (AV:N/AC:L/PR:N/UI:N) means exploitation is a script away once a PoC drops. Apply Oracle's June 2026 Critical Patch Update immediately across all affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); if patching cannot happen immediately, firewall Coherence HTTP management ports to trusted application hosts only as a compensating control.

Is CVE-2026-35310 actively exploited?

No confirmed active exploitation of CVE-2026-35310 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35310?

1. Patch: Apply Oracle Critical Patch Update June 2026 — fixed versions are available for all affected branches (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0). Check https://www.oracle.com/security-alerts/cspujun2026.html for exact patch IDs. 2. Network isolation: Block external access to Oracle Coherence HTTP ports (default 7574, management console 30000) at the perimeter and between untrusted network segments immediately. 3. Inventory: Run an internal scan for Coherence HTTP endpoints reachable without authentication — exposed management interfaces are the primary attack surface. 4. Detect: Enable HTTP request logging on all Coherence nodes and alert on unexpected source IPs or unauthenticated access patterns to the management API. 5. No software workaround exists that fully substitutes for patching — network restriction is the only interim compensating control.

What systems are affected by CVE-2026-35310?

This vulnerability affects the following AI/ML architecture patterns: LLM API response caching layers, Distributed inference pipelines, Enterprise AI platforms (Oracle stack), Feature stores for ML serving, Agent session and memory stores.

What is the CVSS score for CVE-2026-35310?

CVE-2026-35310 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.48%.

What is the AI security impact?

Affected AI Architectures

LLM API response caching layersDistributed inference pipelinesEnterprise AI platforms (Oracle stack)Feature stores for ML servingAgent session and memory stores

MITRE ATLAS Techniques

AML.T0006 Active Scanning

AML.T0025 Exfiltration via Cyber Means

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: 8.7

NIST AI RMF: MANAGE-2.4

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Exploitation Scenario

An adversary targeting an enterprise AI platform discovers Oracle Coherence HTTP management ports exposed via Shodan or internal network scan. Sending a crafted unauthenticated HTTP request triggers the CWE-284 access control bypass, yielding full control of the Coherence cluster. In an AI context, the attacker immediately dumps all cached data — extracting user prompts, LLM responses, and session tokens stored in the grid. They then inject poisoned feature vectors into the cache to silently corrupt downstream ML inference pipelines, or plant malicious data entries designed to influence RAG retrieval results. With full cluster access, the compromised Coherence node becomes a pivot point to reach model-serving containers and vector databases on the same internal network segment.

Weaknesses (CWE)

CWE-284 Improper Access Control

CWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.