CVE-2026-35310 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-35310 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-35310 is a critical unauthenticated remote code execution vulnerability in the Core component of Oracle Coherence, part of the Oracle Fusion Middleware product family.

Technical Detail

The flaw exists in Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and is described by Oracle as easily exploitable by an unauthenticated attacker with network access. The vulnerability allows a remote, unauthenticated attacker to achieve full compromise of the affected Oracle Coherence instance, likely through a deserialization or protocol-level attack vector targeting the Core component. Successful exploitation can result in complete confidentiality, integrity, and availability impact on the host system, consistent with the CVSS 9.8 critical score.

Exploitation Status

No known exploit code has been publicly observed as of June 24, 2026, and this CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Exploit maturity is assessed as none at this time, though the unauthenticated, network-accessible attack surface and critical severity rating make this a high-priority target for weaponization.

Who Is Targeting This

No confirmed, ATTAX-verified threat actor attribution exists for this vulnerability at this time. Reported associations at medium confidence include DEEPPANDA, CARBANAK, LOTUSBLOSSOM, AXIOM, and MOONSTONESLEET; however, these attributions are research-inferred and have not been independently confirmed. Motivations for all reported actors are currently unknown. These associations should be treated as preliminary intelligence pending further corroboration.

What To Do

Apply Oracle's patch for CVE-2026-35310 as part of the relevant Oracle Critical Patch Update cycle immediately, prioritizing internet-facing or network-accessible Coherence deployments across all four affected versions. Organizations running Oracle Coherence in environments where the Core component is reachable from untrusted networks should treat this as an emergency patch given the unauthenticated remote exploitation path. Where patching cannot be completed immediately, restrict network access to Oracle Coherence ports using host-based or perimeter firewall rules to limit exposure to trusted hosts only. Monitor for anomalous deserialization activity, unexpected outbound connections, or process spawning from Coherence service accounts as potential indicators of exploitation attempts.