Oracle Platform Security for Java CVE-2026-60455

Exploitation requires network access to the Oracle Fusion Middleware HTTP interface exposing Oracle Platform Security for Java, plus a low-privileged authenticated foothold (CVSS PR:L) - this is not an unauthenticated flaw. No user interaction is required (UI:N) and attack complexity is low (AC:L). Affected deployments are specifically OPSS versions 12.2.1.4.0 and 14.1.2.0.0 with the Centralized Thirdparty Jars component in use. Limiting factors: the attacker must first possess valid low-level credentials or session access to the middleware, and the OPSS HTTP endpoint must be reachable from the attacker's position, so environments that isolate middleware management interfaces to trusted networks materially reduce exposure.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U) marks this as network-reachable over HTTP, low-complexity, requiring only low privileges and no user interaction - an attractive profile for authenticated attackers or anyone who can obtain a low-level foothold. Oracle explicitly calls it 'easily exploitable,' reinforcing the low-complexity rating. However, no EPSS score, POC, or KEV entry is provided in the input, so real-world exploitation is unconfirmed: there is no public exploit identified at time of analysis and no evidence of active exploitation. This should be treated as a high-priority patch (full takeover, low bar to exploit) but not an emergency 'exploited-in-the-wild' event on current evidence. Note one caveat: the vendor tags it 'Information Disclosure' while the scored impact is C:H/I:H/A:H (full takeover) - the tag understates the assessed impact, so defenders should rely on the CVSS takeover characterization, not the tag.

An attacker who holds a low-privileged account (or has compromised one) sends crafted HTTP requests to a reachable Oracle Fusion Middleware endpoint backed by OPSS, abusing the Centralized Thirdparty Jars component to escalate to full control of the OPSS subsystem - reading protected credentials and policies and altering security decisions. No user interaction or high privileges are needed, and Oracle characterizes the attack as easily exploitable, though no public POC is identified at time of analysis.