What is the CVSS score of CVE-2026-60439?

CVE-2026-60439 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Platform Security for Java are affected by CVE-2026-60439?

Oracle Platform Security for Java (OPSS) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 can be fully compromised by a low-privileged network attacker over HTTP (CVE-2026-60439, CVSS 8.8),…

How to fix or mitigate CVE-2026-60439?

Within 24 hours: Identify all systems running Fusion Middleware 12.2.1.4.0 or 14.1.2.0.0 with OPSS deployed and document network-facing HTTP/HTTPS exposure; contact Oracle support to confirm patch timeline and current availability status. Within 7 days: Once patch status is confirmed, begin planning remediation-either for vendor patch deployment or implementation of network segmentation restricting OPSS access and Web Application Firewall rules targeting exploitation vectors. Within 30 days: Complete remediation across all production and non-production instances via either vendor patch application (versions to be confirmed by Oracle) or enforced compensating controls restricting network access to OPSS components.

Oracle Platform Security for Java CVE-2026-60439

EUVD-2026-47850 HIGH

Improper Privilege Management (CWE-269)

2026-07-22 oracle

GHSA-7882-qhfv-hcm4

Privilege Escalation Java Oracle Oracle Platform Security For Java Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reach with a required low-privilege account gives AV:N/AC:L/PR:L/UI:N; vendor-stated takeover justifies C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 23:03 vuln.today

CVE Published

Jul 22, 2026 - 22:24 cve.org

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access over HTTP to take over the component, per Oracle's July 2026 Critical Patch Update. The flaw yields high confidentiality, integrity, and availability impact and is rated easily exploitable (CVSS 8.8), though no public exploit identified at time of analysis. Because OPSS underpins authentication, authorization, and credential management for the wider Fusion Middleware stack, a takeover has cascading security consequences.

Technical ContextAI

Oracle Platform Security for Java (OPSS) is the security framework underlying Oracle Fusion Middleware and WebLogic-based deployments, providing authentication, authorization, credential store (CSF), keystore, and policy management services to Java EE and Java SE applications. The affected component is 'Centralized Thirdparty Jars', indicating the issue lies in bundled/shared third-party libraries that OPSS consolidates and reuses across products. Oracle assigned no CWE (CWE: N/A) and, consistent with its CPU practice, does not disclose the root-cause class; the vendor tag 'Information Disclosure' hints at a disclosure element, but the CVSS vector's C:H/I:H/A:H and 'takeover' language point to a broader flaw than disclosure alone. The single affected CPE is cpe:2.3:a:oracle_corporation:oracle_platform_security_for_java, aligning the analysis to the OPSS product rather than any specific downstream application.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the authoritative source for the patched bundle/interim-patch numbers for the 12.2.1.4.0 and 14.1.2.0.0 branches - Patch available per vendor advisory; no standalone fixed build number is provided in the input, so obtain the exact patch ID from My Oracle Support per your installed version. Because the attack is network-over-HTTP by a low-privileged user, until patching completes restrict network exposure of Fusion Middleware/WebLogic administrative and application HTTP endpoints to trusted networks or VPN, and tighten the number and privilege of accounts that can authenticate to OPSS-backed applications (side effect: may disrupt legitimate low-privilege integrations). Review and rotate OPSS credential store and keystore secrets after patching in case a foothold existed, and monitor authentication logs for anomalous low-privilege access. Given the 'Centralized Thirdparty Jars' component, confirm that the patch updates the shared third-party libraries across all co-located Fusion Middleware products, not just one application.