CVE-2026-60367: Oracle Platform Security Auth Bypass Flaw

CVE-2026-60367 Overview

CVE-2026-60367 is a critical vulnerability in the Oracle Platform Security for Java (OPSS) product of Oracle Fusion Middleware. The flaw resides in the Centralized Thirdparty Jars component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated remote attacker can exploit the issue over HTTP without user interaction. Successful exploitation results in complete takeover of the Oracle Platform Security for Java instance, impacting confidentiality, integrity, and availability. Oracle disclosed the vulnerability in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated network attackers can fully compromise Oracle Platform Security for Java deployments, gaining control over authentication, authorization, and credential management services used by Oracle Fusion Middleware.

Affected Products

Oracle Platform Security for Java 12.2.1.4.0
Oracle Platform Security for Java 14.1.2.0.0
Oracle Fusion Middleware deployments relying on the Centralized Thirdparty Jars component

Discovery Timeline

2026-07-22 - CVE-2026-60367 published to NVD
2026-07-22 - Last updated in NVD database
July 2026 - Oracle addresses issue in Oracle Security Alert July 2026

Technical Details for CVE-2026-60367

Vulnerability Analysis

Oracle Platform Security for Java provides identity, credential, and authorization services for Oracle Fusion Middleware. The Centralized Thirdparty Jars component bundles shared third-party libraries used across OPSS runtime services. A flaw in this component allows an unauthenticated attacker to send crafted HTTP requests that compromise the OPSS process.

Because OPSS mediates security decisions for higher-level Fusion Middleware services, takeover of the component undermines the trust boundary of every application relying on it. Attackers gain the ability to read protected secrets, alter policy stores, and forge authorization decisions. The attack requires no privileges and no user interaction, which increases the risk of automated mass exploitation once technical details become public.

Root Cause

Oracle has not published the exact root cause. The vulnerability sits within shared third-party libraries centralized by OPSS, which suggests the flaw originates in an embedded dependency handling untrusted network input. Common failure modes for this class of issue include insecure deserialization, unauthenticated management endpoints, and injection flaws in library-provided parsers. Refer to the Oracle Security Alert July 2026 for vendor guidance.

Attack Vector

The attack originates from the network over HTTP. An attacker reaches an exposed OPSS-backed endpoint and issues a crafted request that triggers the vulnerable code path in the Centralized Thirdparty Jars component. No authentication, credentials, or user interaction are required. Exploitation results in full compromise of the OPSS runtime, which can be leveraged to pivot into dependent Fusion Middleware services such as WebLogic Server, Oracle Identity Management, and hosted business applications.

No public proof-of-concept, exploit code, or in-the-wild activity has been documented at the time of publication.

Detection Methods for CVE-2026-60367

Indicators of Compromise

Unexpected HTTP requests to Oracle Fusion Middleware endpoints containing serialized Java payloads or references to internal OPSS classes.
New or modified files under the OPSS domain home, particularly within policy stores, credential stores, and jps-config.xml.
Unauthorized outbound connections initiated by the WebLogic or OPSS Java processes.
Anomalous authentication or authorization decisions logged by dependent Fusion Middleware applications.

Detection Strategies

Enable verbose HTTP request logging on Oracle HTTP Server and WebLogic managed servers, and hunt for anomalous request bodies to OPSS-related URIs.
Baseline the process tree of Fusion Middleware Java processes and alert on unexpected child processes such as shells or curl.
Monitor for modifications to OPSS policy and credential store files outside of scheduled change windows.

Monitoring Recommendations

Ingest WebLogic, OHS, and OPSS audit logs into a centralized SIEM for correlation across Fusion Middleware tiers.
Alert on new administrative principals, role grants, or credential store entries created outside of change management workflows.
Continuously review network exposure of Fusion Middleware admin and application ports to confirm they are not reachable from untrusted networks.

How to Mitigate CVE-2026-60367

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all Oracle Platform Security for Java 12.2.1.4.0 and 14.1.2.0.0 deployments.
Restrict network access to Fusion Middleware management and application endpoints to trusted administrative networks only.
Inventory every Fusion Middleware environment that depends on OPSS and confirm patch status through configuration management tooling.
Rotate credentials stored in the OPSS credential store if the environment cannot be patched within an accelerated window.

Patch Information

Oracle addressed CVE-2026-60367 in the July 2026 Critical Patch Update. Administrators should download and apply the vendor-supplied patch bundle described in the Oracle Security Alert July 2026. Validate the patch level with the Oracle Universal Installer inventory after deployment and restart the affected managed servers to complete remediation.

Workarounds

Place a web application firewall in front of Fusion Middleware endpoints and block anomalous request bodies targeting OPSS components.
Terminate HTTP exposure of non-essential Fusion Middleware services and require VPN or bastion access for administrative traffic.
Enforce strict egress filtering on Fusion Middleware hosts to limit post-exploitation options.

bash

# Verify OPSS patch inventory on a Fusion Middleware Oracle Home
cd $ORACLE_HOME/OPatch
./opatch lsinventory | grep -i "Oracle Platform Security"

# Restrict inbound HTTP traffic to trusted admin subnets (example: firewalld)
sudo firewall-cmd --permanent --zone=drop --add-source=0.0.0.0/0
sudo firewall-cmd --permanent --zone=trusted --add-source=10.0.0.0/24
sudo firewall-cmd --permanent --zone=trusted --add-port=7001-7002/tcp
sudo firewall-cmd --reload