What is the CVSS score of CVE-2026-60367?

CVE-2026-60367 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Platform Security for Java are affected by CVE-2026-60367?

Oracle Platform Security for Java (OPSS) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 can be completely compromised remotely by unauthenticated attackers; no public exploit has been…

How to fix or mitigate CVE-2026-60367?

Within 24 hours: complete inventory of all Oracle Fusion Middleware deployments and identify systems running versions 12.2.1.4.0 or 14.1.2.0.0, documenting network accessibility and data sensitivity. Within 7 days: implement firewall rules restricting HTTP access to affected OPSS instances to authorized administrative networks only, contact Oracle Support to confirm patch development timeline, and analyze logs for signs of prior exploitation attempts. Within 30 days: deploy Web Application Firewall protection specifically configured to detect and block attacks targeting the Centralized Thirdparty Jars component, execute full vulnerability assessment of each affected system for compromise indicators, and establish emergency patching procedures for deployment upon vendor patch release or initiate upgrade planning to patched Fusion Middleware versions.

Oracle Platform Security for Java CVE-2026-60367

EUVD-2026-47857 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-22 oracle

GHSA-82gc-f943-99vh

Privilege Escalation Java Oracle Oracle Platform Security For Java Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states easily exploitable, unauthenticated, network HTTP access with full component takeover, so AV:N/AC:L/PR:N/UI:N and C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 23:00 vuln.today

CVE Published

Jul 22, 2026 - 22:24 cve.org

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Articles & Coverage 1

News Critical RCE in Oracle Platform Security for Java (OPSS) - CVE-2026-60367 Jul 23, 2026

AnalysisAI

Remote takeover of Oracle Platform Security for Java (OPSS), a security framework bundled with Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, allows an unauthenticated attacker with HTTP network access to fully compromise the component. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, Oracle describes it as 'easily exploitable' via the Centralized Thirdparty Jars component. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.

Technical ContextAI

Oracle Platform Security for Java (OPSS) is the standard security foundation underlying Oracle Fusion Middleware and Oracle WebLogic Server, providing authentication, authorization, credential store, keystore, and audit services to Java EE and ADF applications. The affected component, 'Centralized Thirdparty Jars,' relates to shared/bundled third-party libraries used across the middleware stack, meaning the flaw likely resides in a commonly-linked dependency rather than application-specific code, which broadens its reach across Fusion Middleware deployments. Oracle did not assign a CWE (listed as N/A), and the advisory provides no root-cause class; the CVSS profile (network vector, no privileges, full C/I/A impact) is consistent with a deserialization, injection, or authentication-bypass class flaw typical of Java middleware, but the exact weakness cannot be confirmed from the available data.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (Patch available per vendor advisory; an exact patched build number is not enumerated in the provided data) by consulting https://www.oracle.com/security-alerts/cpujul2026.html for the specific patch set for your Fusion Middleware release (12.2.1.4.0 or 14.1.2.0.0) and applying it promptly, as Oracle's CPU patches are cumulative and unauthenticated network exploitability warrants expedited scheduling. Because no vendor workaround is published for this issue, compensating controls until patching should include restricting network reachability to the affected middleware - place WebLogic/Fusion Middleware admin and application HTTP ports behind a segmented network or reverse proxy and block direct internet exposure (trade-off: may disrupt legitimate remote integrations), enforce IP allow-listing or a WAF in front of the HTTP endpoints to filter anomalous requests (trade-off: WAF signatures for an undisclosed flaw offer only partial coverage), and increase monitoring of the affected hosts for anomalous authentication and process activity. Do not treat these controls as a substitute for the CPU patch.