Description
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-22
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is in the Centralized Third‑party Jars component of Oracle Platform Security for Java and allows an attacker to connect over HTTP without any authentication. If exploited, the attacker can take full control of the application, resulting in a total loss of confidentiality, integrity and availability for the affected system. The weakness is reflected in several CWEs, including improper authentication and deserialization issues.

Affected Systems

Oracle Platform Security for Java, a component of Oracle Fusion Middleware, is impacted for versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability is specifically tied to HTTP interfaces exposed by the Centralized Third‑party Jars service.

Risk and Exploitability

With a CVSS v3.1 base score of 9.8, this is a critical flaw that can be remotely triggered over a network with no prior credentials. The EPSS score is less than 1 percent, indicating that the exploitation probability is low but non‑negligible, and the vulnerability is not yet listed in CISA KEV. Nonetheless, the ease of exploitation—no authentication or UI required—makes the risk high for any exposed system.

Generated by OpenCVE AI on August 3, 2026 at 23:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle Platform Security for Java update that addresses CVE‑2026‑60367, following the patch guidance in Oracle’s security alert.
  • Restrict HTTP access to the Centralized Third‑party Jars component with firewall rules or network segmentation so that only trusted internal hosts can reach it.
  • Enforce strong authentication and authorization on all exposed HTTP endpoints, ensuring that only privileged users have the ability to invoke privileged operations.

Generated by OpenCVE AI on August 3, 2026 at 23:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploit in Oracle Platform Security for Java's Centralized Third‑party Jars

Thu, 30 Jul 2026 09:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploit in Oracle Platform Security for Java's Centralized Third‑party Jars

Tue, 28 Jul 2026 17:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution via HTTP in Oracle Platform Security for Java
Weaknesses CWE-284

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution via HTTP in Oracle Platform Security for Java
Weaknesses CWE-284

Thu, 23 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
CWE-287
CWE-306
CWE-502
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle platform Security For Java
CPEs cpe:2.3:a:oracle:platform_security_for_java:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:platform_security_for_java:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle platform Security For Java
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Platform Security For Java
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T14:36:14.349Z

Reserved: 2026-07-08T15:51:40.533Z

Link: CVE-2026-60367

cve-icon Vulnrichment

Updated: 2026-07-23T14:36:10.638Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-22T23:16:35.870

Modified: 2026-07-24T15:17:53.850

Link: CVE-2026-60367

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T23:15:04Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function

  • CWE-502

    Deserialization of Untrusted Data