Oracle Platform Security for Java CVE-2026-60368

Exploitation requires network reachability to the Oracle Platform Security for Java SOAP interface and a low-privileged authenticated account (CVSS PR:L), against supported versions 12.2.1.4.0 or 14.1.2.0.0 of Oracle Fusion Middleware. No user interaction is required (UI:N) and attack complexity is low (AC:L), so a single low-privileged attacker with SOAP access to a vulnerable OPSS deployment can trigger it. The principal limiting factors are the requirement to already hold some valid low-level credentials or foothold (not fully anonymous), the need for direct network access to the SOAP endpoint (mitigable via network segmentation), and applicability only to the two named affected versions.

The signals point to a genuine priority for Oracle Fusion Middleware operators. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes an easily exploitable, low-complexity, network-reachable attack needing only low privileges and no user interaction, resulting in full compromise - Oracle's own language of 'takeover.' No EPSS score, SSVC decision, or POC was provided, and the CVE is not in CISA KEV, so real-world exploitation is currently unproven and probability of active exploitation cannot be quantified from the data. One notable inconsistency: the intelligence Tags label this 'Information Disclosure,' yet the CVSS vector and Oracle description indicate a full C/I/A takeover - the tag understates impact and should be disregarded in favor of the vendor CVSS. Because PR:L means an attacker must already hold some authenticated foothold, this is high-severity but not trivially exploitable by a fully anonymous internet attacker.

An attacker who has obtained low-privileged credentials to an Oracle Fusion Middleware environment sends a crafted SOAP request to the Oracle Platform Security for Java interface, exploiting the flaw to gain full control of the OPSS component and, with it, the security policies and credentials it governs. No user interaction or high privileges are required, and the low attack complexity means the request can be delivered reliably once network access to the SOAP endpoint exists. No public POC has been identified, so exploitation currently requires independent development.