CVE-2026-60369
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable, allows a low-privileged attacker via HTTP to take over the system, with impact on other products (scope change).
Risk Assessment
Risk of full compromise of Oracle Platform Security for Java, potentially leading to loss of confidentiality, integrity, and availability, and affecting other systems.
Recommendation
Apply the patch provided by Oracle for versions 12.2.1.4.0 and 14.1.2.0.0. Restrict HTTP access to trusted users only.
Other vulnerabilities in Oracle Platform Security for Java
See all- CVE-2026-83011High
Vulnerability in Oracle Platform Security for Java (component: Centralized Thirdparty Jars) affects versions 12.2.1.4.0 and 14.1.2.0.0. It is difficult to exploit but requires no authentication and is accessible via HTTP. Successful attack can lead to takeover of the system.
- CVE-2026-82996High
Vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with local logon to the infrastructure can easily exploit it, leading to takeover of the product. Confidentiality, integrity, and availability impacts are high.
- CVE-2016-8281High
An unspecified vulnerability in the Oracle Platform Security for Java component in Oracle Fusion Middleware 12.1.3.0.0, 12.2.1.0.0, and 12.2.1.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability.
- CVE-2026-83020Critical
Vulnerability in Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Affects versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable, allows unauthenticated attacker via HTTP to take over the product, with impact on other products (scope change). CVSS 10.0.
- CVE-2026-82995Critical
Vulnerability in Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Affects versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable, allows unauthenticated attacker via SOAP to take over the product. CVSS 9.8.
- CVE-2026-82994Critical
Vulnerability in Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Affects versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable, allows unauthenticated attacker via LDAP to take over the product. CVSS 9.8.
- CVE-2026-60372Critical
Vulnerability in Oracle Platform Security for Java (Oracle Fusion Middleware) in the Centralized Thirdparty Jars component. Affects versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable by an unauthenticated attacker with network access via HTTP, potentially leading to takeover of Oracle Platform Security for Java. CVSS 9.8.
- CVE-2026-60367Critical
Vulnerability in Oracle Platform Security for Java (component: Centralized Thirdparty Jars) allows unauthenticated attacker via HTTP to compromise the system. CVSS 9.8.
- CVE-2026-60366Critical
Vulnerability in Oracle Platform Security for Java (component: Centralized Thirdparty Jars) allows unauthenticated attacker via HTTP to compromise the system. CVSS 10.0.
- CVE-2026-61246High
Oracle Platform Security for Java (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0 have an easily exploitable vulnerability allowing a low-privileged attacker with network access via HTTP to take over the product. CVSS 8.8.
Original NVD description (English source)
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Security for Java, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).