CVE-2026-60368: Oracle Platform Security for Java RCE

CVE-2026-60368 Overview

CVE-2026-60368 is a high-severity vulnerability in the Oracle Platform Security for Java (OPSS) component of Oracle Fusion Middleware. The flaw resides in the Centralized Thirdparty Jars component and is exploitable over the network through Simple Object Access Protocol (SOAP). A low-privileged attacker with network access can compromise the OPSS instance without user interaction. Successful exploitation results in full takeover of Oracle Platform Security for Java, impacting confidentiality, integrity, and availability. Affected releases are Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0.

Critical Impact
A low-privileged, network-based attacker can achieve complete takeover of Oracle Platform Security for Java through a SOAP-accessible interface, jeopardizing all identity, credential, and authorization services that dependent Fusion Middleware applications rely on.

Affected Products

Oracle Fusion Middleware — Oracle Platform Security for Java 12.2.1.4.0
Oracle Fusion Middleware — Oracle Platform Security for Java 14.1.2.0.0
Downstream Fusion Middleware applications relying on OPSS for authentication, authorization, and credential storage

Discovery Timeline

2026-07-22 - CVE-2026-60368 published to the National Vulnerability Database
2026-07-22 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update — July 2026

Technical Details for CVE-2026-60368

Vulnerability Analysis

Oracle Platform Security for Java provides the identity, credential, policy, and audit services shared by Oracle Fusion Middleware components. The vulnerability is reachable through SOAP endpoints exposed by OPSS, meaning any authenticated user with minimal application privileges can send crafted SOAP messages to the vulnerable service. Oracle categorizes the outcome as complete takeover, which indicates the attacker gains control over OPSS internals rather than access to a narrow subset of data. Given OPSS mediates trust decisions across the Fusion Middleware stack, compromise of this component undermines the security posture of every integrated application that consumes its policies and credentials.

Root Cause

Oracle attributes the weakness to the Centralized Thirdparty Jars component of OPSS. Oracle has not published detailed root-cause information beyond the advisory, but the exploitation profile — network-accessible SOAP, low privileges required, high impact to confidentiality, integrity, and availability — is consistent with unsafe processing of attacker-influenced input inside a shared library path. Details are limited to the Oracle Security Alert July 2026.

Attack Vector

Exploitation requires network reachability to the SOAP interface exposed by OPSS and any low-privileged account. There is no user interaction requirement and the attack complexity is low. An attacker who can authenticate as a standard user submits crafted SOAP requests to the vulnerable Centralized Thirdparty Jars handler, which allows them to subvert OPSS trust decisions and pivot to broader Fusion Middleware compromise.

No public proof-of-concept code has been observed for CVE-2026-60368, and no verified exploit examples are available. Refer to the Oracle advisory for authoritative remediation guidance.

Detection Methods for CVE-2026-60368

Indicators of Compromise

Unexpected SOAP requests to Oracle Platform Security for Java endpoints originating from low-privileged accounts or unusual internal hosts.
Modifications to OPSS policy stores, credential stores, or keystore configuration files outside of change windows.
New or altered entries in the Centralized Thirdparty Jars directory, or unsigned JAR files appearing in OPSS classpaths.
Anomalous authentication or authorization decisions logged by Fusion Middleware applications that depend on OPSS.

Detection Strategies

Monitor WebLogic and Fusion Middleware access logs for SOAP traffic targeting OPSS-related URIs, especially from accounts that historically do not consume these services.
Alert on OPSS audit events that indicate policy, role mapping, or credential store changes performed by non-administrative principals.
Compare deployed JAR inventories against a known-good baseline to flag introduced or modified third-party libraries.

Monitoring Recommendations

Forward WebLogic Server, OPSS audit, and operating system logs to a central analytics platform for correlation.
Track outbound connections from Fusion Middleware hosts to detect post-exploitation activity such as command-and-control or lateral movement.
Establish behavioral baselines for administrative SOAP calls so deviations trigger review.

How to Mitigate CVE-2026-60368

Immediate Actions Required

Apply the fixes contained in the Oracle Critical Patch Update — July 2026 to all affected 12.2.1.4.0 and 14.1.2.0.0 deployments.
Inventory all Fusion Middleware environments that consume OPSS and prioritize internet-adjacent or multi-tenant systems.
Rotate credentials, keys, and secrets stored in OPSS credential stores on hosts where compromise cannot be ruled out.
Review recent OPSS audit logs for unauthorized policy or credential store changes.

Patch Information

Oracle addressed CVE-2026-60368 in the July 2026 Critical Patch Update. Administrators should download and apply the patches referenced in the advisory for Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0. Oracle's standard guidance is to remain on actively supported releases and to apply CPU bundles promptly, since Oracle does not backport fixes to unsupported versions.

Workarounds

Restrict network access to OPSS SOAP endpoints using firewall rules, reverse proxy allow-lists, or WebLogic network channels limited to trusted management networks.
Enforce least privilege on Fusion Middleware application accounts to reduce the pool of principals that could satisfy the low-privilege requirement.
Disable or remove Fusion Middleware applications and SOAP services that are not in active use to reduce the attack surface until patches are applied.

bash

# Example: restrict access to the WebLogic administration and SOAP ports
# to a trusted management subnet using iptables on the middleware host
iptables -A INPUT -p tcp --dport 7001 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7002 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP
iptables -A INPUT -p tcp --dport 7002 -j DROP