CVE-2026-60366: Oracle Platform Security Auth Bypass Flaw

CVE-2026-60366 Overview

CVE-2026-60366 is a critical vulnerability affecting Oracle Platform Security for Java, a component of Oracle Fusion Middleware. The flaw resides in the Centralized Thirdparty Jars component and impacts supported versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can exploit this vulnerability with low complexity. Successful exploitation results in full takeover of Oracle Platform Security for Java. The vulnerability carries a scope change, meaning attacks may significantly impact additional products beyond the vulnerable component itself.

Critical Impact
Unauthenticated remote attackers can achieve full compromise of Oracle Platform Security for Java over the network, with cascading impact on connected Oracle Fusion Middleware products.

Affected Products

Oracle Platform Security for Java 12.2.1.4.0
Oracle Platform Security for Java 14.1.2.0.0
Oracle Fusion Middleware deployments using the Centralized Thirdparty Jars component

Discovery Timeline

2026-07-22 - CVE-2026-60366 published to NVD
2026-07-22 - Last updated in NVD database
July 2026 - Addressed in Oracle Security Alert July 2026

Technical Details for CVE-2026-60366

Vulnerability Analysis

The vulnerability exists in the Centralized Thirdparty Jars component of Oracle Platform Security for Java (OPSS). OPSS provides authentication, authorization, credential management, and cryptography services for Oracle Fusion Middleware applications. A flaw in the handling of third-party JAR processing allows unauthenticated attackers to compromise the security service.

Because OPSS underpins security enforcement for other Oracle Fusion Middleware components, exploitation extends beyond the affected library. The scope change indicated in the CVSS vector confirms that attackers can pivot from OPSS to impact protected products relying on it for identity and access control.

Oracle has not published detailed root cause information. The advisory identifies the outcome as complete takeover with high impact to confidentiality, integrity, and availability.

Root Cause

The root cause resides within the Centralized Thirdparty Jars component used by Oracle Platform Security for Java. Oracle's advisory does not disclose the underlying weakness class, but the exploitation profile is consistent with unauthenticated remote code execution or authorization bypass in a network-exposed Java service.

Attack Vector

Exploitation requires only network access over HTTP. The attacker needs no credentials, no user interaction, and no prior foothold. Any Oracle Fusion Middleware deployment exposing the vulnerable OPSS endpoint to reachable network paths is at risk. Attackers targeting internet-facing or lateral-movement-accessible middleware can gain control of OPSS and propagate to dependent Fusion Middleware products.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-60366

Indicators of Compromise

Unexpected HTTP requests to Oracle Fusion Middleware endpoints hosting OPSS services, particularly from external or unusual internal sources
New or modified JAR files within the OPSS Centralized Thirdparty Jars directory outside patch or maintenance windows
Anomalous child processes spawned by WebLogic or Fusion Middleware Java processes
Outbound network connections from Fusion Middleware hosts to previously unseen destinations

Detection Strategies

Inspect Oracle Fusion Middleware access and diagnostic logs for malformed or unexpected requests referencing OPSS endpoints
Monitor file integrity on OPSS installation directories and third-party JAR locations for unauthorized changes
Correlate authentication service anomalies with process and network telemetry from middleware hosts
Baseline normal OPSS API traffic and alert on deviations in request patterns, response codes, or payload sizes

Monitoring Recommendations

Enable verbose audit logging for OPSS security operations and forward logs to a centralized SIEM
Continuously monitor for new administrative accounts, credential store modifications, or policy changes in OPSS
Track privileged process activity on Fusion Middleware servers, including shell invocations from Java processes
Alert on outbound connections from middleware tiers to non-approved external hosts

How to Mitigate CVE-2026-60366

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected Oracle Fusion Middleware deployments immediately
Inventory all instances of Oracle Platform Security for Java 12.2.1.4.0 and 14.1.2.0.0 in the environment
Restrict network exposure of Fusion Middleware management and OPSS endpoints to trusted networks only
Review Fusion Middleware logs for indicators of exploitation prior to patching

Patch Information

Oracle has released fixes as part of the July 2026 security advisory. Administrators must apply the patches referenced in the Oracle Security Alert July 2026 to remediate CVE-2026-60366. Given the CVSS 3.1 Base Score of 10.0 and unauthenticated network exploitability, patching should be prioritized ahead of routine maintenance windows.

Workarounds

Place vulnerable Fusion Middleware instances behind a web application firewall with strict allow-listing until patches are applied
Segment Fusion Middleware hosts from general user networks and untrusted zones
Disable or restrict access to non-essential OPSS-exposed HTTP endpoints where feasible
Enforce strict egress filtering on middleware hosts to limit post-exploitation impact

bash

# Example: restrict inbound HTTP access to Fusion Middleware host to trusted subnets
iptables -A INPUT -p tcp --dport 7001 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP