CVE-2026-60371 in Platform Security for Java
Summary
by MITRE • 07/23/2026
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Platform Security for Java executes to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Security for Java, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability exists within Oracle Platform Security for Java, specifically in the Centralized Thirdparty Jars component of Oracle Fusion Middleware. The affected versions include 12.2.1.4.0 and 14.1.2.0.0, representing a significant security gap in Oracle's middleware stack that could be exploited by determined attackers. The vulnerability's classification as difficult to exploit indicates that while the attack vector requires specific conditions, the potential impact is severe enough to warrant immediate attention from security teams.
The technical flaw resides in how Oracle Platform Security for Java handles third-party jar files within its centralized management framework. This weakness allows an attacker with physical access to the communication segment connected to the hardware executing Oracle Platform Security for Java to gain complete control over the affected system. The attack requires an attacker to be present on the same physical network segment, which aligns with the CVSS vector's AV:A classification indicating adjacent network access. The low privilege requirement PR:L suggests that once the physical access is established, minimal authentication or authorization levels are needed to carry out the attack.
The operational impact of this vulnerability extends beyond the immediate Oracle Platform Security for Java component, creating a scope change that can affect additional Oracle products within the ecosystem. This cascading effect represents a particularly concerning aspect of the vulnerability since successful exploitation could provide attackers with a foothold that might be leveraged against other systems in the enterprise environment. The CVSS 3.1 Base Score of 8.0 reflects the high severity across all three impact vectors, with confidentiality, integrity, and availability all being severely compromised.
The vulnerability's characteristics align with CWE-269: "Improper Privilege Management" and potentially CWE-427: "Uncontrolled Search Path Element," as the issue involves improper handling of third-party components within a privileged execution environment. From an ATT&CK framework perspective, this vulnerability maps to T1059.007: "Command and Scripting Interpreter: Python" and potentially T1068: "Exploitation for Privilege Escalation," as the attack chain would likely involve leveraging the compromised platform to escalate privileges or move laterally within the network.
Organizations should implement immediate mitigations including network segmentation to isolate Oracle Platform Security for Java instances from unauthorized physical access, enhanced monitoring of network traffic on segments where these systems reside, and verification that third-party jar files are properly validated before deployment. The vulnerability's susceptibility to adjacent network attacks emphasizes the importance of physical security controls, particularly in data center environments where Oracle Fusion Middleware components are deployed. Regular patching and updates should be prioritized, with security teams monitoring Oracle's advisory notices for any additional related vulnerabilities that might compound the risk profile of this component.
The attack scenario requires an attacker to have physical access to the network segment hosting the Oracle Platform Security for Java instance, which limits the attack surface but does not eliminate the threat entirely. This vulnerability represents a classic example of how physical security controls must be integrated with logical security measures, as network-based protections alone may be insufficient against attackers who can establish presence on the same physical network segment. Organizations should also consider implementing additional logging and monitoring capabilities specifically designed to detect anomalous behavior in third-party jar loading operations.
The CVSS vector (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates that while this vulnerability has high attack complexity requirements, the potential for significant damage makes it a critical concern. The scope change component S:C suggests that successful exploitation could extend beyond the immediate target system to affect other components within the broader Oracle Fusion Middleware ecosystem. This characteristic creates additional operational challenges for security teams who must understand the complete attack surface and potential impact chain when addressing this vulnerability.
Security architects should evaluate their current network segmentation strategies to ensure that Oracle Platform Security for Java instances are properly isolated from general network access, even when physical access is controlled. The vulnerability's potential for system takeover requires comprehensive incident response planning that includes specific procedures for handling compromised Oracle Fusion Middleware environments. Organizations should also consider implementing automated tools that can detect and alert on suspicious third-party jar file loading activities within their Oracle Platform Security for Java deployments to provide early warning of potential exploitation attempts.