What is the CVSS score of CVE-2026-60455?

CVE-2026-60455 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Platform Security for Java are affected by CVE-2026-60455?

Oracle Platform Security for Java (OPSS) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 contains a high-severity remote code execution vulnerability (CVSS 8.8) exploitable by low-privileged…

How to fix or mitigate CVE-2026-60455?

Within 24 hours, inventory systems running Fusion Middleware 12.2.1.4.0 or 14.1.2.0.0 and restrict network access to administrative networks only via firewall rules. Within 7 days, deploy Web Application Firewall rules targeting the Centralized Thirdparty Jars component to detect and block exploitation attempts, enforce strict role-based access controls limiting Fusion Middleware use to authorized administrators, and enable comprehensive logging on all access. Within 30 days, contact Oracle support for patched version availability, develop and test an upgrade plan to the patched release, and execute the upgrade while maintaining all compensating controls.

Oracle Platform Security for Java CVE-2026-60455

EUVD-2026-47849 HIGH

Dependency on Vulnerable Third-Party Component (CWE-1395)

2026-07-22 oracle

GHSA-766m-jvf2-r94j

Java Information Disclosure Oracle Oracle Platform Security For Java Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reachability with low complexity, requiring a low-privileged account (PR:L) and no interaction, yielding full OPSS takeover so C/I/A all High, scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 23:04 vuln.today

CVE Published

Jul 22, 2026 - 22:24 cve.org

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker over HTTP, targeting the Centralized Thirdparty Jars component. Oracle rates the flaw 8.8 and describes it as 'easily exploitable,' with successful attacks yielding complete takeover (high confidentiality, integrity, and availability impact). No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

Oracle Platform Security for Java (OPSS) is the security framework underpinning Oracle Fusion Middleware and WebLogic-based deployments, providing authentication, authorization, credential storage, and policy services to Java EE applications. The affected component, 'Centralized Thirdparty Jars,' concerns the shared bundling/management of third-party libraries used across the middleware stack, meaning a defect here can affect any application relying on OPSS. Oracle did not assign a CWE (listed N/A), but the CVSS profile (network HTTP vector, low privilege, full C/I/A takeover with unchanged scope) is consistent with an authenticated flaw that abuses OPSS's own trusted processing rather than a memory-safety bug; the vendor's 'Information Disclosure' tag hints at data exposure as one facet, though the I:H/A:H impact indicates the consequences extend well beyond disclosure to full control of the OPSS subsystem.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - patch available per vendor advisory; Oracle publishes exact patch/bundle numbers per version within the CPU, so administrators of 12.2.1.4.0 and 14.1.2.0.0 should apply the corresponding OPSS/Fusion Middleware patch for their release (a specific standalone fix version is not independently confirmed outside the CPU). Because exploitation requires network HTTP access plus low privileges, effective compensating controls until patching include restricting network reachability of the affected middleware endpoints to trusted management networks, tightening OPSS account privileges and revoking unnecessary low-privileged accounts, and placing a WAF/reverse proxy in front of the Fusion Middleware HTTP listeners; the trade-off is that network restrictions may disrupt legitimate integrations and should be validated against application dependencies before enforcement. These are stopgaps only - the CPU patch is the sole confirmed remediation.