CVE-2026-60369: Oracle Platform Security RCE Vulnerability

CVE-2026-60369 Overview

CVE-2026-60369 is a vulnerability in the Oracle Platform Security for Java (OPSS) product within Oracle Fusion Middleware, specifically affecting the Centralized Thirdparty Jars component. Affected versions include 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can exploit the flaw to fully compromise Oracle Platform Security for Java. The vulnerability carries a scope change, meaning successful exploitation can impact additional products beyond OPSS itself. Oracle disclosed this issue in the July 2026 Critical Patch Update.

Critical Impact
Easily exploitable network-based flaw allowing low-privileged attackers to take over Oracle Platform Security for Java, with scope change affecting adjacent Fusion Middleware components.

Affected Products

Oracle Platform Security for Java 12.2.1.4.0
Oracle Platform Security for Java 14.1.2.0.0
Oracle Fusion Middleware components relying on the Centralized Thirdparty Jars module

Discovery Timeline

2026-07-22 - CVE-2026-60369 published to NVD
2026-07-22 - Last updated in NVD database
July 2026 - Oracle addresses the vulnerability in the Oracle Security Alert July 2026

Technical Details for CVE-2026-60369

Vulnerability Analysis

Oracle Platform Security for Java provides authentication, authorization, credential storage, and cryptographic services to Oracle Fusion Middleware applications. The Centralized Thirdparty Jars component consolidates shared third-party libraries used across OPSS-integrated products. A flaw in this component allows a low-privileged authenticated attacker to escalate impact across product boundaries via HTTP requests.

Successful exploitation results in full compromise of OPSS confidentiality, integrity, and availability. The scope change indicates the attacker can reach beyond the vulnerable component and influence resources managed by other Fusion Middleware products relying on OPSS. Oracle has not published exploit details, and no public proof-of-concept is currently available.

Root Cause

Oracle's advisory does not disclose the specific defect class. The location within Centralized Thirdparty Jars suggests the issue involves how OPSS loads, resolves, or processes shared library functionality exposed to authenticated HTTP clients. See the Oracle Security Alert July 2026 for authoritative technical guidance.

Attack Vector

The attack originates over the network via HTTP. The attacker requires low-level privileges on the target OPSS instance but does not need user interaction. Because attack complexity is low and the scope changes on exploitation, an attacker with a standard OPSS account can pivot into resources belonging to co-hosted Fusion Middleware products. No verified exploitation code has been published by Oracle or third parties.

Detection Methods for CVE-2026-60369

Indicators of Compromise

Unexpected authenticated HTTP requests targeting OPSS endpoints or Centralized Thirdparty Jars resources from low-privileged accounts.
Anomalous Java process behavior in WebLogic or Fusion Middleware domains, including new class loads or reflective operations tied to third-party JARs.
Modifications or new files under OPSS credential stores, policy stores, or the domain lib and common/lib directories.

Detection Strategies

Baseline authenticated HTTP traffic to Fusion Middleware admin and OPSS-managed endpoints and alert on deviations from known clients and paths.
Monitor Fusion Middleware audit logs for privilege changes, policy modifications, and credential store access originating from low-privileged principals.
Correlate WebLogic server logs with host-level process telemetry to identify child processes or outbound connections spawned from managed servers.

Monitoring Recommendations

Enable OPSS auditing at the highest supported level and forward logs to a centralized analytics platform for long-term retention.
Track file integrity on $DOMAIN_HOME, OPSS configuration files, and the Centralized Thirdparty Jars directories.
Alert on outbound network connections from Fusion Middleware managed servers to non-approved destinations.

How to Mitigate CVE-2026-60369

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected OPSS 12.2.1.4.0 and 14.1.2.0.0 deployments as soon as possible.
Inventory all Fusion Middleware products that depend on OPSS and confirm patch coverage across the full domain.
Rotate OPSS credentials, keystore passwords, and any secrets stored in the credential store after patching to eliminate residual exposure.
Restrict network access to Fusion Middleware admin channels and OPSS endpoints to trusted management networks.

Patch Information

Oracle published fixes as part of the July 2026 Critical Patch Update. Refer to the Oracle Security Alert July 2026 for the applicable patch identifiers, prerequisites, and installation guidance for each affected version.

Workarounds

Reduce the number of accounts with any OPSS privileges and enforce the principle of least privilege for Fusion Middleware roles.
Place Fusion Middleware admin and OPSS interfaces behind an authenticated reverse proxy or VPN until patches are applied.
Enable web application firewall rules to block anomalous request patterns to Fusion Middleware management endpoints.

bash

# Example: restrict OPSS admin endpoints to a management CIDR at the reverse proxy
# Replace 10.10.0.0/24 with your management network
location /opss/ {
    allow 10.10.0.0/24;
    deny all;
    proxy_pass http://fusion-middleware-backend;
}