Description
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-22
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in Oracle Platform Security for Java allows an attacker with low privileges to exploit the SOAP service. It is inferred that this can grant the attacker full control over the application, leading to loss of confidentiality, integrity, and availability. The vulnerability resides in the Centralized Thirdparty Jars component and allows the attacker to compromise and take over Oracle Platform Security for Java.

Affected Systems

Oracle Platform Security for Java in Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0, are affected by this vulnerability.

Risk and Exploitability

The CVSS 3.1 Base Score of 8.8 indicates high severity. The EPSS score is < 1%, showing a very low probability that the vulnerability will be exploited in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need network access to the SOAP endpoint and only low privilege. The low EPSS score indicates a low probability of exploitation.

Generated by OpenCVE AI on August 3, 2026 at 23:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle Platform Security for Java patch released in July 2026, which addresses the missing input validation flaw identified as CWE‑1104.
  • Restrict SOAP traffic to trusted hosts by implementing network segmentation and firewall rules, ensuring only authorized users can access the SOAP endpoint.
  • Enable detailed logging on the SOAP service and configure alerts to detect and investigate suspicious access attempts.

Generated by OpenCVE AI on August 3, 2026 at 23:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Title SOAP Server Vulnerability Enables Full Control Over Oracle Platform Security for Java

Sat, 01 Aug 2026 04:15:00 +0000

Type Values Removed Values Added
Title Low Privileged SOAP Attack Enables Full Takeover of Oracle Platform Security for Java

Sun, 26 Jul 2026 05:15:00 +0000

Type Values Removed Values Added
Title Low Privileged SOAP Attack Enables Full Takeover of Oracle Platform Security for Java

Thu, 23 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1104
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle platform Security For Java
CPEs cpe:2.3:a:oracle:platform_security_for_java:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:platform_security_for_java:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle platform Security For Java
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Platform Security For Java
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T14:35:26.958Z

Reserved: 2026-07-08T15:51:40.533Z

Link: CVE-2026-60368

cve-icon Vulnrichment

Updated: 2026-07-23T14:35:23.847Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-22T23:16:35.980

Modified: 2026-07-24T15:17:48.807

Link: CVE-2026-60368

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T23:15:04Z

Weaknesses
  • CWE-1104

    Use of Unmaintained Third Party Components