Oracle Platform Security for Java CVE-2026-60372

The only prerequisite from the data is network HTTP access to an affected Oracle Platform Security for Java instance (versions 12.2.1.4.0 or 14.1.2.0.0) within Oracle Fusion Middleware - per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special configuration are required, so this is remote unauthenticated exploitation against standard deployments of these versions. The primary limiting factors are therefore version (only 12.2.1.4.0 and 14.1.2.0.0 are named) and reachability: exploitation requires the vulnerable Fusion Middleware HTTP surface to be network-accessible to the attacker, so instances confined to isolated internal/management networks are substantially harder to reach. The specific request or protocol interaction that triggers the flaw is not disclosed in Oracle's advisory.

The signals are strongly weighted toward high priority: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) indicates network-reachable, low-complexity, unauthenticated exploitation with total impact, and Oracle explicitly calls it "easily exploitable" and capable of full "takeover." Counterbalancing this, there is no EPSS score provided, no POC, and no CISA KEV listing, so there is currently no evidence of active or automated exploitation - the urgency is driven by the intrinsic vector, not by observed attacks. One notable inconsistency: the vendor tag says "Information Disclosure" while the CVSS claims full integrity and availability impact and "takeover"; Oracle CPU descriptions are historically vague and sometimes over- or under-state real-world impact, so the true impact ceiling should be verified against the July 2026 CPU details. EPSS data is missing and should be checked once published. Net: treat as a real, high-priority patch based on exposure and impact, while recognizing exploitation has not yet been demonstrated publicly.

An attacker who can reach an exposed Oracle Fusion Middleware HTTP endpoint sends a crafted request to the OPSS "Centralized Thirdparty Jars" component without any credentials or user interaction, exploiting the flaw to gain full control ("takeover") of the OPSS layer. From there, because OPSS mediates credential stores, keystores, and authorization for the middleware, the attacker can read sensitive secrets and manipulate or disrupt dependent applications. No public exploit is identified at time of analysis, so this scenario reflects the CVSS-implied capability rather than an observed attack.