What is the CVSS score of CVE-2026-60370?

CVE-2026-60370 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Java are affected by CVE-2026-60370?

Oracle Platform Security for Java (OPSS) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 contains a critical vulnerability enabling complete takeover of authentication and access controls.

How to fix or mitigate CVE-2026-60370?

Within 24 hours: identify all systems running Oracle Fusion Middleware versions 12.2.1.4.0 or 14.1.2.0.0 and restrict network access to OPSS components to authorized internal networks only, removing any direct internet exposure. Within 7 days: conduct a security assessment of all OPSS systems to determine potential compromise, isolate affected systems from networks containing sensitive data, and document detailed network access controls. Within 30 days: establish a vendor communication plan with Oracle to track patch availability, evaluate upgrade and remediation options for all affected systems, and prepare a staged rollout plan for deployment.

Java CVE-2026-60370

EUVD-2026-47854 HIGH

Improper Restriction of Rendered UI Layers or Frames (CWE-1021)

2026-07-22 oracle

GHSA-qx8q-j4v6-8m6r

XSS Java Oracle Oracle Platform Security For Java Oracle Corporation

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 23:02 vuln.today

CVE Published

Jul 22, 2026 - 22:24 cve.org

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Platform Security for Java (OPSS), a security framework bundled with Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0, is possible via its Centralized Thirdparty Jars component. A low-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability, though the attack is rated difficult to execute (high attack complexity). No public exploit identified at time of analysis and the flaw is not in CISA KEV, but it was disclosed by Oracle in the July 2026 Critical Patch Update.