Oracle Platform Security for Java CVE-2026-60373

Exploitation requires network reachability to the OPSS/Fusion Middleware HTTP interface and possession of a low-privilege authenticated account (CVSS PR:L), targeting the Centralized Thirdparty Jars component of Oracle Platform Security for Java versions 12.2.1.4.0 or 14.1.2.0.0. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once an attacker has any valid low-privilege session with HTTP access, exploitation is straightforward. Limiting factors: the required authentication (this is not anonymous/unauthenticated), the need for HTTP-layer reachability to the affected service, and applicability only to the two named supported versions - internet-exposed instances with weak low-privilege account controls are most at risk.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) signals a genuinely high-priority issue: network-reachable over HTTP, low attack complexity, no user interaction, and full triad impact culminating in product takeover. The main moderating factor is PR:L - the attacker must already hold some low-privilege authenticated access, which limits purely anonymous internet exploitation. No EPSS score, SSVC decision, KEV entry, or POC was provided, so exploitation probability cannot be quantified and no active exploitation is confirmed; this tempers urgency relative to a KEV-listed bug but does not lower the intrinsic severity. A data conflict is worth flagging: the tags label this "Information Disclosure," yet the CVSS vector and Oracle's "takeover" language indicate full integrity and availability compromise - treat the tag as incomplete and rely on the CVSS/description, which describe far more than disclosure.

An attacker who already holds a low-privilege authenticated account (for example, a limited application or console user) sends crafted HTTP requests to the OPSS-backed Fusion Middleware endpoint, abusing the Centralized Thirdparty Jars component to escalate to full control of the OPSS instance. Because attack complexity is low and no user interaction is required, a single reachable session is enough to pivot to reading credentials/keystores, altering security policy, and disrupting service. No public exploit identified at time of analysis, so this reflects the CVSS-derived path rather than an observed exploit.