What is the CVSS score of CVE-2026-60373?

CVE-2026-60373 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Platform Security for Java are affected by CVE-2026-60373?

Oracle Platform Security for Java (OPSS), which protects all Oracle Fusion Middleware applications, can be completely compromised by low-privilege authenticated attackers over HTTP.

How to fix or mitigate CVE-2026-60373?

Within 24 hours: identify all Oracle Fusion Middleware instances running OPSS and confirm their versions; implement network-level access restrictions limiting HTTP traffic to OPSS management interfaces to known administrative IP ranges only; enable comprehensive logging of all access to Centralized Thirdparty Jars components. Within 7 days: conduct a security assessment of all low-privilege service accounts with access to affected OPSS instances and implement principle-of-least-privilege reviews; establish daily monitoring alerts for suspicious authentication attempts and unauthorized access patterns to protected resources. Within 30 days: monitor Oracle Security Alerts for CVE-2026-60373 patch availability and immediately schedule patching upon release, with testing in non-production environments before production deployment.

Oracle Platform Security for Java CVE-2026-60373

EUVD-2026-47851 HIGH

Improper Privilege Management (CWE-269)

2026-07-22 oracle

GHSA-2xv9-f975-hc73

Privilege Escalation Java Oracle Oracle Platform Security For Java Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

HTTP-reachable (AV:N), low complexity (AC:L), requires a low-privilege account (PR:L), no interaction (UI:N); Oracle-described full product takeover yields C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 23:04 vuln.today

CVE Published

Jul 22, 2026 - 22:24 cve.org

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Platform Security for Java (OPSS), a security framework within Oracle Fusion Middleware, is possible when a low-privileged attacker reaches the affected instance over HTTP via the Centralized Thirdparty Jars component. Oracle rates the flaw CVSS 3.1 8.8 and describes it as "easily exploitable," resulting in a complete takeover of OPSS with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and it is not in CISA KEV, but the low attack complexity and only a low-privilege authenticated prerequisite make it a strong candidate for prompt patching in Oracle environments.

Technical ContextAI

Oracle Platform Security for Java (OPSS) is the standard security abstraction layer used across Oracle Fusion Middleware and WebLogic deployments, providing authentication, authorization, credential/keystore management, and audit services to Java EE applications. The vulnerable element is the "Centralized Thirdparty Jars" component - the bundled/shared third-party library set OPSS ships and loads - which suggests the root cause is likely a vulnerable or mishandled dependency rather than OPSS's own core logic. Oracle assigned no CWE (CWE: N/A), so the precise weakness class (e.g., deserialization, injection, or a known flaw in a bundled library) cannot be confirmed from the provided data; the CPE cpe:2.3:a:oracle_corporation:oracle_platform_security_for_java:*:*:*:*:*:*:*:* confirms the affected product line without pinning exact library versions.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html), the authoritative source for the patched bundle-patch numbers for OPSS 12.2.1.4.0 and 14.1.2.0.0; Oracle did not publish a discrete semantic fix version in the provided data, so use the CPU-listed patch for your exact Fusion Middleware release (Patch available per vendor advisory). Because the flaw is network/HTTP reachable and only requires low privileges, compensating controls until patching completes include restricting network access to the OPSS/Fusion Middleware management and application HTTP endpoints to trusted administrative networks only, tightening account provisioning so few low-privilege accounts exist, and placing a WAF/reverse-proxy in front of the affected HTTP listeners to filter anomalous requests. Trade-offs: network restrictions can break legitimate integrations and inter-tier calls, and WAF rules for an unknown-CWE flaw are best-effort and may miss the specific vector - none of these substitute for the CPU patch.