Description
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-22
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw resides in the Centralized Thirdparty Jars component of Oracle Platform Security for Java. Even with low privileges, an attacker who can reach the platform over HTTP can trigger the vulnerability. The attack grants full control of the platform, yielding loss of confidentiality, integrity and availability. The weakness arises from improper access control (CWE‑269, CWE‑306) and an insecure deserialization flaw (CWE‑502).

Affected Systems

Affected releases are Oracle Platform Security for Java 12.2.1.4.0 and 14.1.2.0.0, which are part of Oracle Fusion Middleware. All other releases are not reported to be vulnerable.

Risk and Exploitability

The CVSS 3.1 base score of 8.8 indicates high severity, with an attack vector of network, low privilege and no user interaction. The EPSS score of < 1 % suggests that while the logic is easy to trigger, real‑world exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, yet the remote nature and platform takeover potential warrant immediate guarding of HTTP endpoints or network isolation. Attackers can remotely exploit the flaw via HTTP if the component is reachable, enabling complete platform compromise.

Generated by OpenCVE AI on August 3, 2026 at 23:04 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle patch for Platform Security for Java 12.2.1.4.0 and 14.1.2.0.0 that addresses the Centralized Thirdparty Jars flaw, as outlined in Oracle’s July 2026 CPU alert.
  • If the patch is not yet available, upgrade to a later, non‑affected release or apply any interim fix that removes or restricts the vulnerable component.
  • As a temporary defense, block or isolate the HTTP endpoint that exposes the vulnerable component by restricting access to trusted networks, enforcing strong authentication, or deploying firewall rules.

Generated by OpenCVE AI on August 3, 2026 at 23:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Centralized Thirdparty Jars in Oracle Platform Security for Java

Sun, 02 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Unauthenticated HTTP Access in Oracle Platform Security for Java

Thu, 30 Jul 2026 08:45:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Unauthenticated HTTP Access in Oracle Platform Security for Java

Tue, 28 Jul 2026 17:45:00 +0000

Type Values Removed Values Added
Title Remote Code Execution Vulnerability in Oracle Platform Security for Java Via HTTP

Sun, 26 Jul 2026 05:15:00 +0000

Type Values Removed Values Added
Title Remote Code Execution Vulnerability in Oracle Platform Security for Java Via HTTP

Thu, 23 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
CWE-306
CWE-502
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle platform Security For Java
CPEs cpe:2.3:a:oracle:platform_security_for_java:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:platform_security_for_java:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle platform Security For Java
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Platform Security For Java
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T14:31:19.102Z

Reserved: 2026-07-08T15:51:40.537Z

Link: CVE-2026-60439

cve-icon Vulnrichment

Updated: 2026-07-23T14:31:15.572Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-22T23:16:36.640

Modified: 2026-07-24T15:17:22.563

Link: CVE-2026-60439

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T23:15:04Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-306

    Missing Authentication for Critical Function

  • CWE-502

    Deserialization of Untrusted Data