Description
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-22
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability arises from inadequate validation of centralized third‑party JAR files in Oracle Platform Security for Java. The flaw, which represents multiple weaknesses—missing authorization (CWE‑269), improper access control (CWE‑284), missing authentication (CWE‑306), and deserialization of untrusted data (CWE‑502)—allows an unauthenticated attacker with network access to execute arbitrary code, resulting in full control over the service. The CVSS 3.1 base score of 9.8 reflects complete confidentiality, integrity, and availability loss.

Affected Systems

Oracle Platform Security for Java, versions 12.2.1.4.0 and 14.1.2.0.0, are affected. Any deployment using these releases should be considered at risk.

Risk and Exploitability

The flaw is easily exploitable over HTTP without authentication. Attackers need only reach the service, and the CVSS vector indicates a network attack with low effort and no user interaction. The EPSS score of <1% indicates a low but non‑zero probability of exploitation in the wild. The vulnerability is not yet listed in CISA’s KEV catalog, so no publicly known exploit is confirmed, yet the high severity warrants urgent action.

Generated by OpenCVE AI on August 5, 2026 at 01:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch for Oracle Platform Security for Java 12.2.1.4.0 or 14.1.2.0.0 as soon as it is available. The fix mitigates the identified CWE-502 (Deserialization of Untrusted Data) along with related authorization weaknesses (CWE-269, CWE-284, CWE-306).
  • If a patch is not yet available, restrict inbound HTTP traffic to the Platform Security for Java service or place the service behind a strict network perimeter. This containment limits the exposure to the vulnerabilities categorized under CWE-269/284/306/502.
  • Continuously monitor access logs for abnormal requests or patterns aimed at the service, and raise alerts for any suspicious activity. Effective monitoring helps detect exploitation attempts related to the identified weaknesses (CWE-502 deserialization attacks and other authentication/authorization flaws).

Generated by OpenCVE AI on August 5, 2026 at 01:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 01:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Remote Code Execution in Oracle Platform Security for Java

Thu, 30 Jul 2026 09:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Remote Code Execution in Oracle Platform Security for Java

Tue, 28 Jul 2026 17:45:00 +0000

Type Values Removed Values Added
Title Untrusted Input in Oracle Platform Security for Java Enables Remote Code Execution via HTTP
Weaknesses CWE-94

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Untrusted Input in Oracle Platform Security for Java Enables Remote Code Execution via HTTP
Weaknesses CWE-94

Thu, 23 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
CWE-284
CWE-306
CWE-502
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle platform Security For Java
CPEs cpe:2.3:a:oracle:platform_security_for_java:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:platform_security_for_java:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle platform Security For Java
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Platform Security For Java
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T14:32:58.133Z

Reserved: 2026-07-08T15:51:40.533Z

Link: CVE-2026-60372

cve-icon Vulnrichment

Updated: 2026-07-23T14:32:54.291Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-22T23:16:36.420

Modified: 2026-07-24T15:17:31.247

Link: CVE-2026-60372

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T01:15:03Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control

  • CWE-306

    Missing Authentication for Critical Function

  • CWE-502

    Deserialization of Untrusted Data