Oracle Platform Security For Java CVE-2026-60370

Oracle Platform Security for Java (OPSS) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 contains a critical vulnerability enabling complete takeover of authentication and access controls. Organizations running these affected versions face significant risk of unauthorized data access, system compromise, and service disruption. Immediate inventory and network containment are essential while patch availability is tracked with the vendor.

Within 24 hours: identify all systems running Oracle Fusion Middleware versions 12.2.1.4.0 or 14.1.2.0.0 and restrict network access to OPSS components to authorized internal networks only, removing any direct internet exposure. Within 7 days: conduct a security assessment of all OPSS systems to determine potential compromise, isolate affected systems from networks containing sensitive data, and document detailed network access controls. Within 30 days: establish a vendor communication plan with Oracle to track patch availability, evaluate upgrade and remediation options for all affected systems, and prepare a staged rollout plan for deployment.

No vendor-released patch identified at time of analysis. Interim mitigations: restrict OPSS component network access to authorized internal IPs only; implement web application firewall rules to block suspicious HTTP requests targeting the Centralized Thirdparty Jars component; monitor authentication and administrative logs for anomalous activity; isolate affected systems from networks containing sensitive data.