What is the CVSS score of CVE-2026-60371?

CVE-2026-60371 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Java are affected by CVE-2026-60371?

Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware is vulnerable to complete system compromise by attackers within the local network (CVSS 8.0).

How to fix or mitigate CVE-2026-60371?

Within 24 hours, identify all systems running OPSS in your infrastructure and assess which critical applications depend on it for security services. Within 7 days, implement network segmentation to isolate OPSS systems from untrusted network segments, enforce strict access controls and multi-factor authentication for OPSS administrative functions, and enable detailed logging of all authentication and API access. Within 30 days, apply the vendor-released patch immediately upon availability (monitor Oracle security advisories), conduct security reviews of systems dependent on OPSS to verify they have independent security controls, and re-assess the organization's reliance on OPSS for critical security functions.

Java CVE-2026-60371

EUVD-2026-47853 HIGH

Information Exposure (CWE-200)

2026-07-22 oracle

GHSA-9g94-cv97-3vwq

Oracle Java Information Disclosure Oracle Platform Security For Java

8.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.0 HIGH

AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 23:02 vuln.today

CVE Published

Jul 22, 2026 - 22:24 cve.org

HIGH 8.0

DescriptionCVE.org

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Platform Security for Java executes to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Security for Java, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Platform Security for Java (OPSS), a security framework within Oracle Fusion Middleware, is possible for a low-privileged attacker positioned on the same physical communication segment as the host. Disclosed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 score of 8.0 and a scope change, meaning successful exploitation can significantly impact additional products beyond OPSS itself. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, identify all systems running OPSS in your infrastructure and assess which critical applications depend on it for security services. …

Threat intelligence, references, and detailed analysis are available after sign-in.