CVE-2026-60373 Overview
CVE-2026-60373 is a vulnerability in the Oracle Platform Security for Java (OPSS) product of Oracle Fusion Middleware, specifically within the Centralized Thirdparty Jars component. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can exploit this weakness to fully compromise Oracle Platform Security for Java. Successful exploitation results in complete takeover of the affected component, impacting confidentiality, integrity, and availability.
Critical Impact
Authenticated attackers over the network can achieve full takeover of Oracle Platform Security for Java, compromising the security services underpinning Fusion Middleware deployments.
Affected Products
- Oracle Fusion Middleware — Oracle Platform Security for Java 12.2.1.4.0
- Oracle Fusion Middleware — Oracle Platform Security for Java 14.1.2.0.0
- Affected component: Centralized Thirdparty Jars
Discovery Timeline
- 2026-07-22 - CVE-2026-60373 published to NVD
- 2026-07-22 - Last updated in NVD database
- Vendor disclosure published in the Oracle Security Alert July 2026
Technical Details for CVE-2026-60373
Vulnerability Analysis
Oracle Platform Security for Java delivers authentication, authorization, credential storage, and cryptographic services across Fusion Middleware components. The flaw resides in the Centralized Thirdparty Jars component, which manages shared third-party Java libraries used across the platform. An authenticated attacker with only low privileges can reach the vulnerable functionality over HTTP. Successful exploitation grants the attacker full control of the OPSS component, effectively undermining the security layer that other Fusion Middleware services rely on.
Because OPSS provides identity and policy services to dependent applications, a takeover cascades into loss of trust for authentication decisions, policy enforcement, and credential material managed by the platform. The vulnerability is scored 8.8 under CVSS 3.1 with high impact across all three security properties.
Root Cause
Oracle has not disclosed the underlying defect class. The affected Centralized Thirdparty Jars component handles shared libraries used by OPSS, and vulnerabilities in this surface historically involve deserialization, path handling, or dependency-driven code paths. Refer to the Oracle Security Alert July 2026 for authoritative technical detail once made available.
Attack Vector
The attack vector is network-based over HTTP. The attacker must hold a valid low-privileged account on the target instance. No user interaction is required, and exploitation complexity is low. Once the attacker reaches the exposed HTTP endpoint associated with the Centralized Thirdparty Jars component, they can drive the flaw to hijack OPSS.
No public proof-of-concept or exploit code is currently referenced in the enriched CVE data. See the Oracle Security Alert July 2026 for vendor-provided technical detail.
Detection Methods for CVE-2026-60373
Indicators of Compromise
- Unexpected HTTP requests to Fusion Middleware endpoints associated with OPSS or Centralized Thirdparty Jars handling by authenticated low-privileged accounts.
- Anomalous changes to OPSS policy stores, credential stores, or keystore contents managed by Fusion Middleware.
- Creation of new administrative principals or role grants in OPSS-managed identity stores shortly after suspicious HTTP activity.
Detection Strategies
- Correlate WebLogic and Fusion Middleware access logs against OPSS audit logs to identify low-privileged sessions performing sensitive third-party jar or policy operations.
- Alert on unexpected Java process behavior on Fusion Middleware hosts, including spawning of shells or writes to $DOMAIN_HOME/config and $ORACLE_HOME directories.
- Baseline HTTP request patterns to admin and management URIs, and flag deviations originating from non-administrative user accounts.
Monitoring Recommendations
- Enable and centralize Fusion Middleware audit logging, including the OPSS Audit Framework, and forward to a SIEM for long-term retention.
- Monitor egress from Fusion Middleware hosts for unusual outbound connections that may indicate post-exploitation activity.
- Continuously review privilege assignments in OPSS policy stores for unauthorized elevation.
How to Mitigate CVE-2026-60373
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Fusion Middleware deployments running affected versions 12.2.1.4.0 and 14.1.2.0.0.
- Restrict HTTP access to Fusion Middleware administrative and management endpoints to trusted management networks only.
- Audit and rotate credentials for low-privileged Fusion Middleware accounts that may have been reachable to an attacker.
- Review OPSS policy and credential stores for unauthorized modifications since the affected versions were deployed.
Patch Information
Oracle addressed CVE-2026-60373 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 advisory for exact patch identifiers, prerequisites, and application order for Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0.
Workarounds
- Enforce network segmentation so that Fusion Middleware management interfaces are not reachable from general user or internet-facing networks.
- Apply strict role-based access control to reduce the population of accounts that could satisfy the low-privilege precondition.
- Place a reverse proxy or web application firewall in front of Fusion Middleware to restrict and inspect HTTP traffic to OPSS-related endpoints until patching is complete.
# Example: restrict access to WebLogic/Fusion Middleware admin ports at the host firewall
# Allow only the management subnet 10.10.20.0/24 to reach the admin port 7001
iptables -A INPUT -p tcp --dport 7001 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
