EUVD-2026-47858
GHSA-6g36-jj7p-rh8m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Oracle confirms unauthenticated network HTTP exploitation with low complexity and full takeover, and the cross-product impact justifies scope change with C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Security for Java, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Articles & Coverage 1
AnalysisAI
Complete takeover of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is possible by an unauthenticated remote attacker over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw resides in the 'Centralized Thirdparty Jars' component and carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning successful exploitation can significantly impact products beyond OPSS itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the perfect CVSS score and 'easily exploitable' vendor language make this a top-priority patch.
Technical ContextAI
Oracle Platform Security for Java (OPSS) is the security framework underlying Oracle Fusion Middleware and WebLogic-based products, providing authentication, authorization, credential/keystore management, auditing, and policy services (JAAS/JAAS-based) that many Oracle enterprise applications depend on. The affected component, 'Centralized Thirdparty Jars', indicates the root cause almost certainly lies in a bundled/shaded third-party Java library shared across Fusion Middleware, which explains the scope-change (S:C) rating - a defect in this common dependency propagates trust and impact into other Oracle products that consume OPSS. No CWE was assigned by Oracle, so the exact weakness class (e.g., deserialization, XXE, expression-language injection, or a vulnerable logging/serialization library) cannot be confirmed from the data, though 'Centralized Thirdparty Jars' + unauthenticated network HTTP + full CIA takeover is the classic signature of an insecure-deserialization or vulnerable-library flaw. The single CPE provided (cpe:2.3:a:oracle_corporation:oracle_platform_security_for_java:*) is version-agnostic; Oracle's advisory text is authoritative for the affected releases.
RemediationAI
Apply the Oracle Critical Patch Update of July 2026 as the primary fix; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch/bundle for your release of Oracle Platform Security for Java (12.2.1.4.0 and 14.1.2.0.0). No standalone fixed version string is provided in the input, so treat this as 'Patch available per vendor advisory' and pull the specific CPU patch numbers from the Oracle security alert for your environment; do not invent a version. Given the maximum score, prioritize this over other CPU items and schedule emergency maintenance. If patching cannot be immediate, compensating controls include restricting network reachability to Fusion Middleware/OPSS HTTP endpoints via network ACLs, WAF, or firewall segmentation so only trusted management networks can reach them (trade-off: may break legitimate integrations and administrative access), and increasing monitoring/logging on those hosts for anomalous deserialization or error patterns. Because the component is a shared third-party jar, verify all co-located Fusion Middleware products are patched together to avoid leaving a vulnerable copy of the library in place.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today