CVE-2026-60372: Oracle Platform Security for Java RCE Flaw

CVE-2026-60372 Overview

CVE-2026-60372 is a critical vulnerability in Oracle Platform Security for Java (OPSS), a component of Oracle Fusion Middleware. The flaw resides in the Centralized Thirdparty Jars component and affects versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can exploit this vulnerability without user interaction. Successful exploitation results in complete takeover of Oracle Platform Security for Java, compromising confidentiality, integrity, and availability of the affected system.

Critical Impact
Remote unauthenticated attackers can achieve full compromise of Oracle Platform Security for Java over the network with low attack complexity, leading to complete system takeover.

Affected Products

Oracle Platform Security for Java version 12.2.1.4.0
Oracle Platform Security for Java version 14.1.2.0.0
Oracle Fusion Middleware — Centralized Thirdparty Jars component

Discovery Timeline

2026-07-22 - CVE-2026-60372 published to NVD
2026-07-22 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update

Technical Details for CVE-2026-60372

Vulnerability Analysis

The vulnerability affects Oracle Platform Security for Java (OPSS), which provides authentication, authorization, credential management, and cryptography services to Oracle Fusion Middleware applications. The flaw resides in the Centralized Thirdparty Jars component, a shared library subsystem used across Fusion Middleware deployments.

An attacker only needs network access to the HTTP interface of the affected OPSS component. No credentials, elevated privileges, or user interaction are required. Because OPSS underpins security services for many Fusion Middleware products, compromise of this component can cascade into broader Oracle deployments that depend on it for identity and access enforcement.

Successful exploitation results in full takeover, meaning the attacker can read sensitive data, modify security policies, and disrupt service availability.

Root Cause

Oracle has not published detailed technical root cause information. The advisory identifies the Centralized Thirdparty Jars component as the affected subsystem. Historically, similar OPSS advisories have involved unsafe processing of untrusted input in shared libraries, including deserialization or class-loading flaws in third-party dependencies bundled with Fusion Middleware.

Attack Vector

The attack is delivered over the network via HTTP. The attacker sends a crafted request to the exposed OPSS endpoint of a vulnerable Fusion Middleware instance. Because authentication is not required, any host that can reach the HTTP listener is a viable source. Refer to the Oracle Critical Patch Update advisory for vendor-supplied details.

No verified public proof-of-concept code is available at this time.

Detection Methods for CVE-2026-60372

Indicators of Compromise

Unexpected HTTP requests to Oracle Fusion Middleware endpoints originating from untrusted networks or unusual source addresses.
New or modified Java processes spawned by WebLogic or OPSS-related services outside normal deployment windows.
Unauthorized changes to OPSS policy stores, credential stores, or jps-config.xml configuration files.
Outbound network connections from Fusion Middleware hosts to unknown external endpoints.

Detection Strategies

Monitor HTTP access logs on Fusion Middleware servers for anomalous request patterns targeting OPSS or third-party JAR handling endpoints.
Enable and review WebLogic and OPSS audit logs for authentication events that bypass expected identity flows.
Correlate process creation and file integrity events on Fusion Middleware hosts to detect post-exploitation activity such as web shell deployment or credential harvesting.

Monitoring Recommendations

Baseline normal traffic to Oracle Fusion Middleware listeners and alert on deviations, particularly unauthenticated requests to internal management paths.
Track outbound connections from middleware tiers, which typically should not initiate arbitrary external HTTP or DNS traffic.
Alert on modifications to OPSS configuration files, credential wallets, and deployed third-party JAR files.

How to Mitigate CVE-2026-60372

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected Fusion Middleware instances running versions 12.2.1.4.0 and 14.1.2.0.0.
Inventory all deployments of Oracle Platform Security for Java and prioritize internet-exposed systems for immediate remediation.
Restrict network access to Fusion Middleware HTTP endpoints to trusted management networks until patching is complete.
Review recent HTTP and audit logs for indicators of prior exploitation attempts.

Patch Information

Oracle addressed CVE-2026-60372 in the July 2026 Critical Patch Update. Administrators should download and apply the applicable patches for their Fusion Middleware version from the Oracle Critical Patch Update advisory. Oracle recommends applying CPU patches without delay because Oracle products are frequent targets of active exploitation once details become public.

Workarounds

Place affected Fusion Middleware instances behind a web application firewall or reverse proxy that enforces authentication before requests reach OPSS.
Segment middleware tiers from user and internet networks using firewall rules and restrict HTTP access to required application traffic only.
Disable or remove unused Fusion Middleware components that expose OPSS endpoints where feasible.

bash

# Example: restrict HTTP access to Fusion Middleware admin ports to a management subnet
iptables -A INPUT -p tcp --dport 7001 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP