Description
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Security for Java, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Published: 2026-07-22
Score: 10 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is located in the Centralized Thirdparty Jars component of Oracle Platform Security for Java. An unauthenticated attacker with network access via HTTP can compromise the service, potentially leading to a full takeover that compromises confidentiality, integrity, and availability for the platform and may affect other Oracle Fusion Middleware products because of the scope change.

Affected Systems

The vulnerability affects Oracle’s Platform Security for Java versions 12.2.1.4.0 and 14.1.2.0.0; no other products or versions are currently listed by Oracle as impacted.

Risk and Exploitability

The CVSS 3.1 base score of 10.0 signals that the impact is catastrophic if exploited. Although the EPSS score is below 1%, the severity of the flaw indicates a high potential for compromise. The vulnerability is not listed in the CISA KEV catalog, yet the combination of being unauthenticated, having a network-based attack vector, and the potential for complete system compromise suggests a significant threat. Attackers can reach the vulnerable component directly over HTTP, assuming the service is network reachable from the attacker’s location.

Generated by OpenCVE AI on August 3, 2026 at 23:08 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle CPU July 2026 patch for Oracle Platform Security for Java to upgrade beyond versions 12.2.1.4.0 and 14.1.2.0.0
  • Restrict HTTP access to the Platform Security service with firewall rules or IP whitelisting, limiting exposure to trusted internal hosts
  • Implement network segmentation and enforce least-privilege policies for administrative accounts that manage the Platform Security for Java service

Generated by OpenCVE AI on August 3, 2026 at 23:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Remote Code Execution in Oracle Platform Security for Java

Sun, 02 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Remote Code Execution in Oracle Platform Security for Java

Thu, 30 Jul 2026 09:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Remote Code Execution in Oracle Platform Security for Java

Tue, 28 Jul 2026 17:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution via HTTP in Oracle Platform Security for Java

Sun, 26 Jul 2026 05:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution via HTTP in Oracle Platform Security for Java

Thu, 23 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
CWE-284
CWE-306
CWE-502
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Security for Java, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
First Time appeared Oracle
Oracle platform Security For Java
CPEs cpe:2.3:a:oracle:platform_security_for_java:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:platform_security_for_java:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle platform Security For Java
References
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Oracle Platform Security For Java
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T14:37:07.291Z

Reserved: 2026-07-08T15:51:40.533Z

Link: CVE-2026-60366

cve-icon Vulnrichment

Updated: 2026-07-23T14:37:03.268Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-22T23:16:35.757

Modified: 2026-07-23T19:01:53.483

Link: CVE-2026-60366

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T23:15:04Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control

  • CWE-306

    Missing Authentication for Critical Function

  • CWE-502

    Deserialization of Untrusted Data