CVE-2026-60371
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) versions 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit, requires physical segment access and low privileges. Successful attack can lead to product takeover and impact other products (scope change). CVSS 8.0.
Risk Assessment
The risk is takeover of Oracle Platform Security for Java by an attacker with local network access, potentially compromising confidentiality, integrity, and availability across the Oracle Fusion Middleware environment.
Recommendation
Apply patches provided by Oracle in the Critical Patch Update (CPU) for the affected versions. Restricting local network access can reduce risk.
Other vulnerabilities in Oracle Platform Security for Java
See all- CVE-2016-8281High
An unspecified vulnerability in the Oracle Platform Security for Java component in Oracle Fusion Middleware 12.1.3.0.0, 12.2.1.0.0, and 12.2.1.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability.
- CVE-2026-60372Critical
Vulnerability in Oracle Platform Security for Java (Oracle Fusion Middleware) in the Centralized Thirdparty Jars component. Affects versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable by an unauthenticated attacker with network access via HTTP, potentially leading to takeover of Oracle Platform Security for Java. CVSS 9.8.
- CVE-2026-60369Critical
Vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable, allows a low-privileged attacker via HTTP to take over the system, with impact on other products (scope change).
- CVE-2026-60367Critical
Vulnerability in Oracle Platform Security for Java (component: Centralized Thirdparty Jars) allows unauthenticated attacker via HTTP to compromise the system. CVSS 9.8.
- CVE-2026-60366Critical
Vulnerability in Oracle Platform Security for Java (component: Centralized Thirdparty Jars) allows unauthenticated attacker via HTTP to compromise the system. CVSS 10.0.
- CVE-2026-61246High
Oracle Platform Security for Java (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0 have an easily exploitable vulnerability allowing a low-privileged attacker with network access via HTTP to take over the product. CVSS 8.8.
- CVE-2026-60455High
Vulnerability in Oracle Platform Security for Java (component: Centralized Thirdparty Jars) in versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable by a low-privileged attacker with network access via HTTP, can lead to takeover of Oracle Platform Security for Java. CVSS 8.8.
- CVE-2026-60439High
A vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can compromise the component. CVSS 8.8.
- CVE-2026-60373High
Vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can compromise the system.
- CVE-2026-60370High
A vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) versions 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit, it allows a low-privileged attacker with network access via HTTP to compromise and take over the component. CVSS 7.5.
Original NVD description (English source)
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Platform Security for Java executes to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Security for Java, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).