What is the CVSS score of CVE-2026-60372?

CVE-2026-60372 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Platform Security for Java are affected by CVE-2026-60372?

A critical, unauthenticated remote code execution vulnerability in Oracle Platform Security for Java (OPSS) within Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 enables attackers to…

How to fix or mitigate CVE-2026-60372?

Within 24 hours: identify and inventory all Oracle Fusion Middleware systems running OPSS 12.2.1.4.0 or 14.1.2.0.0, establish incident response procedures, and activate emergency change approval processes. Within 7 days: restrict network access to OPSS components to authorized internal networks only, removing any internet-facing exposure; deploy Web Application Firewall rules and intrusion detection signatures targeting CVE-2026-60372 HTTP exploitation patterns; and institute 24/7 monitoring for suspicious HTTP traffic and exploitation attempts. Within 30 days: apply the patch when released in Oracle's July 2026 Critical Patch Update, deploying to production systems first and completing non-production systems within the same 30-day window.

Oracle Platform Security for Java CVE-2026-60372

EUVD-2026-47852 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-22 oracle

GHSA-xrvw-2f36-252m

Privilege Escalation Java Oracle Oracle Platform Security For Java Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor states unauthenticated, network HTTP, easily exploitable with full takeover, giving AV:N/AC:L/PR:N/UI:N and C/I/A:H; retained despite the Information Disclosure tag conflict.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 23:03 vuln.today

CVE Published

Jul 22, 2026 - 22:24 cve.org

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise ("takeover") of Oracle Platform Security for Java (OPSS), a core security framework shipped inside Oracle Fusion Middleware, is possible by an unauthenticated remote attacker over HTTP against versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates this 9.8 with full confidentiality, integrity, and availability loss and describes it as "easily exploitable," so it should be treated as a top-priority patch in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile (no authentication, no user interaction) makes it an attractive target once details or patches are reverse-engineered.

Technical ContextAI

Oracle Platform Security for Java (OPSS) is the standard security and identity services layer embedded across Oracle Fusion Middleware (WebLogic Server, SOA, WebCenter, IDM, etc.), providing authentication, authorization, credential store, keystore, and audit services to Java EE and JavaSE applications. The affected subcomponent is "Centralized Thirdparty Jars," i.e. the bundled third-party library management within the middleware stack, which strongly suggests the root cause is a vulnerable/embedded third-party dependency rather than OPSS's own logic. Oracle did not assign a CWE (CWE: N/A) and the advisory text is deliberately generic, so the exact flaw class is not disclosed; the "Information Disclosure" tag hints at a data-exposure primitive, though Oracle's own CIA:H/H/H scoring implies escalation to full control. The single CPE provided (cpe:2.3:a:oracle_corporation:oracle_platform_security_for_java) is unversioned, so precise affected builds come from the description rather than the CPE.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - patch available per vendor advisory; Oracle CPU patches are cumulative and version-specific per Fusion Middleware release, so apply the OPSS/Fusion Middleware patch corresponding to your 12.2.1.4.0 or 14.1.2.0.0 installation (no standalone fixed version string is published outside the CPU). Because Oracle provides fixes only through the quarterly CPU and no vendor workaround is listed, compensating controls until patching are: restrict network reachability of the affected Fusion Middleware HTTP endpoints to trusted management networks and place them behind a WAF/reverse proxy (trade-off: may break legitimate remote integrations or admin access); disable or firewall any externally exposed OPSS/Fusion Middleware management and application ports (trade-off: reduces availability of those services); and monitor for anomalous requests to the affected services. Given the unauthenticated network vector, removing internet exposure of these middleware instances is the highest-value interim control. Verify your exact patch bundle number against the CPU July 2026 advisory before deployment.