CVE-2026-60372 in Platform Security for Java
Summary
by MITRE • 07/23/2026
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability exists within Oracle Platform Security for Java, specifically in the Centralized Thirdparty Jars component of Oracle Fusion Middleware. The affected versions 12.2.1.4.0 and 14.1.2.0.0 represent critical security gaps that expose the platform to unauthorized access. The vulnerability's exploitability is classified as easily accessible, meaning that attackers with simple network connectivity can potentially compromise the system without requiring authentication credentials. This represents a significant risk to enterprise environments where Oracle Fusion Middleware components are deployed.
The technical flaw stems from insufficient authentication mechanisms within the HTTP interface of the Platform Security for Java component. Attackers can leverage this weakness to gain complete control over the affected system through unauthenticated network access, effectively bypassing normal security controls that should protect against unauthorized intrusion attempts. The vulnerability's CVSS 3.1 base score of 9.8 indicates a critical severity level with high impacts across all three core security principles: confidentiality, integrity, and availability.
The operational impact of this vulnerability extends beyond simple system compromise to potentially enable complete takeover of the Oracle Platform Security for Java environment. This means that successful exploitation could allow attackers to execute arbitrary code, modify system configurations, access sensitive data, or disrupt service availability entirely. Organizations relying on this platform security component face significant risk of data breaches and system compromise that could affect their entire middleware infrastructure and underlying applications.
Security mitigations should prioritize immediate patching of affected versions to address the authentication bypass vulnerability. Organizations must also implement network segmentation and access controls to limit exposure of the affected components to untrusted networks. Monitoring for unauthorized access attempts and implementing intrusion detection systems can help identify exploitation attempts. This vulnerability aligns with CWE-287 which addresses improper authentication issues, and maps to ATT&CK technique T1190 for exploiting vulnerabilities in software applications. Organizations should also consider implementing network-level firewalls and restricting HTTP access to only trusted administrative networks while maintaining regular security assessments of their middleware environments.