Oracle Platform Security for Java CVE-2026-60369

Exploitation requires the attacker to hold low-level privileges (PR:L) - some valid authenticated foothold in the Fusion Middleware environment - plus network reachability to the OPSS HTTP interface exposing the Centralized Thirdparty Jars component; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The vulnerable code ships in the bundled third-party JARs of OPSS 12.2.1.4.0 and 14.1.2.0.0, so default deployments of those versions are in scope. The limiting factor is the required low privilege level, which rules out fully anonymous exploitation but is easily satisfied in shared, multi-application, or multi-tenant middleware deployments; the scope change means impact is not confined to OPSS itself.

This is a genuine high priority rather than an inflated high-CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with a scope change that propagates impact to other products and full confidentiality, integrity, and availability loss; Oracle itself characterizes the flaw as 'easily exploitable.' No EPSS score, KEV listing, POC, or SSVC decision data was provided, so probabilistic and real-world-exploitation signals are absent - the assessment rests on the vendor CVSS and description alone. The single meaningful limiting factor is the PR:L requirement: an attacker needs an existing low-level authenticated foothold, which narrows purely anonymous internet-wide exploitation but is trivially met in most multi-application or multi-tenant middleware environments. No signal conflicts were observed; the primary gaps are the missing CWE and the lack of any corroboration beyond Oracle's own CPU.

An attacker holding any low-privilege authenticated account on a Fusion Middleware deployment sends a crafted HTTP request that reaches the vulnerable Centralized Thirdparty Jars code path in OPSS. Exploiting the low-complexity flaw, they escalate to full control of Oracle Platform Security for Java and, thanks to the scope change, pivot to compromise data and services in additional products sharing the platform. No public POC has been identified, though Oracle rates the issue easily exploitable.