CVE-2026-60368
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) allows a low-privileged attacker with network access via SOAP to take over the system. CVSS score 8.8.
Risk Assessment
Successful attack leads to full compromise of Oracle Platform Security for Java, potentially causing loss of confidentiality, integrity, and availability.
Recommendation
Apply the patches provided by Oracle for versions 12.2.1.4.0 and 14.1.2.0.0 immediately.
Other vulnerabilities in Oracle Platform Security for Java
See all- CVE-2016-8281High
An unspecified vulnerability in the Oracle Platform Security for Java component in Oracle Fusion Middleware 12.1.3.0.0, 12.2.1.0.0, and 12.2.1.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability.
- CVE-2026-60372Critical
Vulnerability in Oracle Platform Security for Java (Oracle Fusion Middleware) in the Centralized Thirdparty Jars component. Affects versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable by an unauthenticated attacker with network access via HTTP, potentially leading to takeover of Oracle Platform Security for Java. CVSS 9.8.
- CVE-2026-60369Critical
Vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable, allows a low-privileged attacker via HTTP to take over the system, with impact on other products (scope change).
- CVE-2026-60367Critical
Vulnerability in Oracle Platform Security for Java (component: Centralized Thirdparty Jars) allows unauthenticated attacker via HTTP to compromise the system. CVSS 9.8.
- CVE-2026-60366Critical
Vulnerability in Oracle Platform Security for Java (component: Centralized Thirdparty Jars) allows unauthenticated attacker via HTTP to compromise the system. CVSS 10.0.
- CVE-2026-61246High
Oracle Platform Security for Java (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0 have an easily exploitable vulnerability allowing a low-privileged attacker with network access via HTTP to take over the product. CVSS 8.8.
- CVE-2026-60455High
Vulnerability in Oracle Platform Security for Java (component: Centralized Thirdparty Jars) in versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable by a low-privileged attacker with network access via HTTP, can lead to takeover of Oracle Platform Security for Java. CVSS 8.8.
- CVE-2026-60439High
A vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can compromise the component. CVSS 8.8.
- CVE-2026-60373High
Vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can compromise the system.
- CVE-2026-60371High
A vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) versions 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit, requires physical segment access and low privileges. Successful attack can lead to product takeover and impact other products (scope change). CVSS 8.0.
Original NVD description (English source)
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).