What is the CVSS score of CVE-2026-60368?

CVE-2026-60368 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Platform Security for Java are affected by CVE-2026-60368?

Oracle Platform Security for Java (OPSS) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 can be fully compromised by low-privileged network attackers via crafted SOAP requests, yielding…

How to fix or mitigate CVE-2026-60368?

Within 24 hours: Identify and enumerate all systems running Fusion Middleware 12.2.1.4.0 or 14.1.2.0.0 with OPSS enabled, and immediately restrict network access to OPSS ports to authorized internal systems only. Within 7 days: Deploy Web Application Firewall (WAF) or network-level inspection rules to block or alert on anomalous SOAP requests to OPSS endpoints, enable detailed logging of OPSS access and privilege changes, and contact Oracle Support for patch availability timeline and interim workaround guidance. Within 30 days: Develop and execute upgrade plan to patched Fusion Middleware release once available, implement SOAP request signing and validation mechanisms, and conduct penetration testing on OPSS configuration for residual privilege escalation risks.

Oracle Platform Security for Java CVE-2026-60368

EUVD-2026-47856 HIGH

Use of Unmaintained Third Party Components (CWE-1104)

2026-07-22 oracle

GHSA-c6c2-g2hr-g6pc

Java Information Disclosure Oracle Oracle Platform Security For Java Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network SOAP delivery (AV:N) with low complexity (AC:L) needs a low-privileged account (PR:L) and no interaction; vendor confirms full takeover, so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 23:00 vuln.today

CVE Published

Jul 22, 2026 - 22:24 cve.org

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Platform Security for Java (OPSS) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged attacker with network access can compromise the component via crafted SOAP requests. Oracle rates this CVSS 8.8 with high confidentiality, integrity, and availability impact, meaning successful exploitation yields complete control of the OPSS component rather than mere data exposure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Platform Security for Java (OPSS) is the standard security framework underpinning Oracle Fusion Middleware and WebLogic-based applications, providing authentication, authorization, credential storage, and policy management for Java EE and standalone Java components. The affected subcomponent is 'Centralized Thirdparty Jars', and the attack surface is the SOAP web-services interface, indicating the flaw is reached through XML/SOAP message processing. Oracle does not assign a CWE (listed N/A), so the precise root-cause class is unconfirmed; the CPE cpe:2.3:a:oracle_corporation:oracle_platform_security_for_java confirms the affected product line but the wildcard version field does not by itself delimit the fixed release.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); patch availability is confirmed by the vendor advisory, though the exact patched OPSS build number was not provided in the source data and should be taken directly from the CPU patch matrix for 12.2.1.4.0 and 14.1.2.0.0. Because the vector is network SOAP with low-privilege access, prioritize patching internet- and intranet-exposed Fusion Middleware/WebLogic instances first. Until patching is complete, compensating controls include restricting network reachability of the OPSS SOAP endpoints to trusted management networks via firewall or WebLogic network-channel ACLs, tightening account provisioning so fewer low-privileged accounts exist, and monitoring SOAP request logs for anomalous payloads - note these controls reduce but do not eliminate exposure since any authenticated low-privileged user retains an attack path.