Oracle Platform Security for Java CVE-2026-60367

The affected deployment must be Oracle Fusion Middleware running Oracle Platform Security for Java at version 12.2.1.4.0 or 14.1.2.0.0 with its HTTP interface reachable by the attacker. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions beyond network HTTP access are required - remote unauthenticated exploitation is possible against affected default configurations, with no authentication, no user interaction, and low complexity. The primary limiting factors are therefore version (only the two named releases are stated affected) and network reachability of the middleware's HTTP endpoint; environments that restrict OPSS/WebLogic HTTP exposure to trusted networks materially reduce realistic exploitability.

The signals point to a genuine high priority rather than an inflated score: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) indicates remote, unauthenticated, low-complexity exploitation with total compromise of the component, and Oracle explicitly characterizes it as 'easily exploitable.' No EPSS score, KEV listing, POC, or SSVC decision data was supplied, so exploitation probability and automatability cannot be quantified from the input - absence of KEV means no confirmed active exploitation, and absence of a POC means no public exploit is identified, but neither reduces the underlying exposure. Note a data conflict worth verifying: the input Tags include 'Information Disclosure,' yet the description and CVSS assert full integrity and availability impact ('takeover'), so the tag understates the actual impact and the CVSS-described full-compromise scope should be treated as authoritative. Because OPSS underpins WebLogic/Fusion Middleware, a compromise of this component can cascade to the applications relying on it, elevating real-world risk despite the missing exploitation-probability data.

An attacker who can reach the HTTP interface of an internet-facing or internally-exposed Oracle Fusion Middleware/WebLogic instance sends a crafted request targeting the OPSS Centralized Thirdparty Jars component, requiring no credentials or user interaction. Because attack complexity is low and privileges are none, a single successful request can yield full compromise of the OPSS component and, by extension, the security services middleware applications depend on. No public POC is currently identified, so exploitation would presently require independent development of the exploit.