What is the CVSS score of CVE-2026-61246?

CVE-2026-61246 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Platform Security for Java are affected by CVE-2026-61246?

Oracle Platform Security for Java (OPSS) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 can be completely compromised by low-privileged attackers with HTTP network access, exposing all data…

How to fix or mitigate CVE-2026-61246?

Within 24 hours, conduct a complete inventory of all Oracle Fusion Middleware systems and identify any running OPSS versions 12.2.1.4.0 or 14.1.2.0.0; document network exposure and connected applications. Within 7 days, implement network firewall rules restricting HTTP access to OPSS systems to authorized internal networks only, reduce low-privileged user privileges where possible, and enable detailed access logging and alerting on OPSS component activity. Within 30 days, establish direct communication with Oracle support to track patch availability, develop and test a migration plan to non-vulnerable Oracle Fusion Middleware releases when released, and prioritize upgrades for systems handling sensitive data or critical operations.

Oracle Platform Security for Java CVE-2026-61246

EUVD-2026-47848 HIGH

Improper Privilege Management (CWE-269)

2026-07-22 oracle

GHSA-4gp2-hc93-r36x

Privilege Escalation Java Oracle Oracle Platform Security For Java Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Oracle confirms easy HTTP exploitation by a low-privileged attacker with no user interaction yielding full takeover, so AV:N/AC:L/PR:L/UI:N and C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 23:05 vuln.today

CVE Published

Jul 22, 2026 - 22:24 cve.org

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle Platform Security for Java (OPSS) is possible where a low-privileged attacker with HTTP network access can fully compromise the confidentiality, integrity, and availability of the service. The flaw resides in the Centralized Thirdparty Jars component and affects Oracle Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0. It carries a CVSS 3.1 base score of 8.8 and was disclosed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis.

Technical ContextAI

Oracle Platform Security for Java (OPSS) is the core security framework underpinning Oracle Fusion Middleware and WebLogic-based deployments, providing authentication, authorization, credential store, keystore, and audit services to Java EE and ADF applications. The vulnerable element is the 'Centralized Thirdparty Jars' component, which manages the shared bundled third-party libraries used across the middleware stack - a common vector for deserialization, injection, or vulnerable-dependency issues in Java stacks. Oracle did not assign a CWE (listed as N/A) and does not publish root-cause detail in its CPU advisories, so the precise weakness class cannot be confirmed from available data. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_platform_security_for_java, spanning the 12.2.1.4.0 and 14.1.2.0.0 middleware trains.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to the affected 12.2.1.4.0 and 14.1.2.0.0 middleware installations; this is patch available per vendor advisory, as Oracle CPUs distribute cumulative bundle patches rather than a single named fix version, so consult the advisory for the exact patch number for your platform. Ensure the underlying Fusion Middleware and WebLogic homes are patched, not just deployed applications, since OPSS is a base library. Until patching is complete, reduce exposure by restricting HTTP access to the affected middleware management and application endpoints to trusted networks or via a reverse proxy/WAF, and tighten the privileges of the low-level accounts an attacker would leverage (the vector requires PR:L), accepting that network restrictions may disrupt legitimate integrations that depend on those endpoints. No vendor-supplied standalone workaround is documented, so patching is the only confirmed remediation.