Description
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-22
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle Platform Security for Java contains an easily exploitable flaw that permits a low‑privileged attacker with network access via HTTP to gain full control of the system. The vulnerability enables compromise of confidentiality, integrity, and availability, as indicated by the CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Affected Systems

Oracle Corporation – Oracle Platform Security for Java. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected.

Risk and Exploitability

The flaw can be leveraged remotely over HTTP; a low‑privileged attacker can send a crafted request to the target and take over the application. The CVSS score reflects a high severity, and the EPSS score of <1% indicates a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, but its high scoring and remote attack path make it a significant risk.

Generated by OpenCVE AI on August 3, 2026 at 23:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest security patches released by Oracle for Oracle Platform Security for Java
  • Restrict HTTP access to the Platform Security for Java service to trusted networks or enforce firewall rules
  • Enforce strict validation and control over third‑party JARs used by the application

Generated by OpenCVE AI on August 3, 2026 at 23:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Unvalidated Third-Party JARs in Oracle Platform Security for Java

Thu, 30 Jul 2026 08:45:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Unvalidated Third-Party JARs in Oracle Platform Security for Java

Tue, 28 Jul 2026 17:45:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via HTTP in Oracle Platform Security for Java
Weaknesses CWE-284

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via HTTP in Oracle Platform Security for Java
Weaknesses CWE-284

Thu, 23 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
CWE-306
CWE-502
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle platform Security For Java
CPEs cpe:2.3:a:oracle:platform_security_for_java:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:platform_security_for_java:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle platform Security For Java
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Platform Security For Java
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T14:30:34.222Z

Reserved: 2026-07-08T15:52:20.743Z

Link: CVE-2026-61246

cve-icon Vulnrichment

Updated: 2026-07-23T14:30:30.155Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-22T23:16:36.867

Modified: 2026-07-24T15:17:11.857

Link: CVE-2026-61246

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T23:15:04Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-306

    Missing Authentication for Critical Function

  • CWE-502

    Deserialization of Untrusted Data