What is the CVSS score of CVE-2026-60369?

CVE-2026-60369 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Platform Security for Java are affected by CVE-2026-60369?

Oracle Platform Security for Java (OPSS) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is vulnerable to complete takeover via HTTP from low-privileged attackers, with potential scope to…

How to fix or mitigate CVE-2026-60369?

Within 24 hours, inventory all Oracle Fusion Middleware deployments to identify instances running versions 12.2.1.4.0 or 14.1.2.0.0 and assess network exposure of the Centralized Thirdparty Jars component. Within 7 days, contact Oracle Support regarding patch timeline and implement emergency network segmentation to restrict HTTP access to affected OPSS components from untrusted networks. Within 30 days, apply vendor-released patch immediately upon availability, deprioritizing other updates until this is complete.

Oracle Platform Security for Java CVE-2026-60369

EUVD-2026-47855 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-22 oracle

GHSA-xgxc-m69w-gg4w

Privilege Escalation Java Oracle Oracle Platform Security For Java Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network HTTP reachable with low complexity and only low privileges; scope change to other products with full C/I/A takeover per Oracle's description.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 23:02 vuln.today

CVE Published

Jul 22, 2026 - 22:24 cve.org

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Security for Java, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Articles & Coverage 1

News Critical RCE in Oracle Fusion Middleware OPSS (Java) - CVE-2026-60369 Jul 23, 2026

AnalysisAI

Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged attacker over HTTP through the Centralized Thirdparty Jars component. Because the flaw carries a scope change, successful exploitation can result in complete takeover of OPSS and significantly impact additional connected products, earning a near-maximum CVSS 3.1 base score of 9.9. No public exploit has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a high-priority patch.

Technical ContextAI

Oracle Platform Security for Java (OPSS) is the core security framework underpinning Oracle Fusion Middleware and WebLogic-based deployments, providing authentication, authorization, credential and keystore management, and audit services to applications running on the platform. The affected element is the 'Centralized Thirdparty Jars' component, meaning the weakness stems from bundled third-party libraries shared across the middleware stack rather than OPSS's own security logic - a classic transitive/library exposure that helps explain the cross-product (scope-change) impact. Oracle's advisory does not map a CWE (listed as N/A), so the precise root-cause weakness class is not disclosed; the 'Information Disclosure' tag combined with full C/I/A impact suggests a shared-library flaw that can leak data and then be leveraged into broader takeover.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update, which is the authoritative source for the exact patch numbers and versions for OPSS 12.2.1.4.0 and 14.1.2.0.0 - see https://www.oracle.com/security-alerts/cpujul2026.html (Patch available per vendor advisory; no standalone fix version string is provided in the input, so obtain the specific patch ID from the CPU matrix). Because the root cause is in bundled third-party JARs, ensure the CPU-supplied updated libraries are deployed across every Fusion Middleware domain that embeds OPSS, not only a single application. Until patching completes, reduce exposure by restricting network access to the middleware HTTP endpoints to trusted management networks and tightening the low-privilege accounts that could serve as the PR:L foothold; note these are compensating controls only, since the scope-change nature means any internally reachable attacker with a low privilege can still reach the component, and over-restricting middleware HTTP ports may disrupt legitimate application traffic.