CVE-2026-61246
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Oracle Platform Security for Java (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0 have an easily exploitable vulnerability allowing a low-privileged attacker with network access via HTTP to take over the product. CVSS 8.8.
Risk Assessment
Takeover of Oracle Platform Security for Java can lead to full compromise of the Java environment, including confidentiality, integrity, and availability of data.
Recommendation
Apply the Oracle patch for Oracle Platform Security for Java for versions 12.2.1.4.0 and 14.1.2.0.0.
Other vulnerabilities in Oracle Platform Security for Java
See all- CVE-2016-8281High
An unspecified vulnerability in the Oracle Platform Security for Java component in Oracle Fusion Middleware 12.1.3.0.0, 12.2.1.0.0, and 12.2.1.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability.
- CVE-2026-60372Critical
Vulnerability in Oracle Platform Security for Java (Oracle Fusion Middleware) in the Centralized Thirdparty Jars component. Affects versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable by an unauthenticated attacker with network access via HTTP, potentially leading to takeover of Oracle Platform Security for Java. CVSS 9.8.
- CVE-2026-60369Critical
Vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable, allows a low-privileged attacker via HTTP to take over the system, with impact on other products (scope change).
- CVE-2026-60367Critical
Vulnerability in Oracle Platform Security for Java (component: Centralized Thirdparty Jars) allows unauthenticated attacker via HTTP to compromise the system. CVSS 9.8.
- CVE-2026-60366Critical
Vulnerability in Oracle Platform Security for Java (component: Centralized Thirdparty Jars) allows unauthenticated attacker via HTTP to compromise the system. CVSS 10.0.
- CVE-2026-60455High
Vulnerability in Oracle Platform Security for Java (component: Centralized Thirdparty Jars) in versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable by a low-privileged attacker with network access via HTTP, can lead to takeover of Oracle Platform Security for Java. CVSS 8.8.
- CVE-2026-60439High
A vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can compromise the component. CVSS 8.8.
- CVE-2026-60373High
Vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can compromise the system.
- CVE-2026-60371High
A vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) versions 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit, requires physical segment access and low privileges. Successful attack can lead to product takeover and impact other products (scope change). CVSS 8.0.
- CVE-2026-60370High
A vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) versions 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit, it allows a low-privileged attacker with network access via HTTP to compromise and take over the component. CVSS 7.5.
Original NVD description (English source)
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).