CVE-2026-61246: Oracle Platform Security Escalation Flaw

CVE-2026-61246 Overview

CVE-2026-61246 is a high-severity vulnerability affecting the Oracle Platform Security for Java (OPSS) product within Oracle Fusion Middleware. The flaw resides in the Centralized Thirdparty Jars component and impacts supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access over HTTP can exploit the weakness to fully compromise Oracle Platform Security for Java. Successful exploitation results in complete takeover of the OPSS instance, impacting confidentiality, integrity, and availability.

Critical Impact
Authenticated attackers with minimal privileges can take over Oracle Platform Security for Java remotely over HTTP, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

Oracle Fusion Middleware — Oracle Platform Security for Java 12.2.1.4.0
Oracle Fusion Middleware — Oracle Platform Security for Java 14.1.2.0.0
Centralized Thirdparty Jars component

Discovery Timeline

2026-07-22 - CVE-2026-61246 published to NVD
2026-07-22 - Last updated in NVD database
Oracle disclosed the issue in the Oracle Security Alert - July 2026

Technical Details for CVE-2026-61246

Vulnerability Analysis

Oracle Platform Security for Java provides a portable security framework for Oracle Fusion Middleware, delivering authentication, authorization, credential management, and cryptographic services. The affected Centralized Thirdparty Jars component manages shared third-party libraries used across Fusion Middleware deployments.

The vulnerability is remotely exploitable over HTTP and requires only low privileges. Oracle rates the flaw with high confidentiality, integrity, and availability impact, and describes successful attacks as resulting in full takeover of the OPSS product. Attack complexity is low and no user interaction is required, which increases the risk in environments exposing OPSS-backed Fusion Middleware endpoints to internal or partner networks.

Root Cause

Oracle has not released detailed root cause information in the public advisory. Based on the component context — Centralized Thirdparty Jars — the weakness relates to processing performed by shared third-party libraries invoked by OPSS through authenticated HTTP-accessible services. Consult the Oracle Critical Patch Update - July 2026 for authoritative technical details.

Attack Vector

An attacker requires network reachability to an HTTP endpoint exposed by an OPSS-integrated Oracle Fusion Middleware deployment and a low-privileged account. The attacker sends crafted HTTP requests that reach code paths in the Centralized Thirdparty Jars component. Because the scope is unchanged and impact is high across all three CIA properties, a successful request permits the attacker to execute privileged actions against OPSS and dependent Fusion Middleware services.

No public proof-of-concept or exploit code is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-61246

Indicators of Compromise

Unexpected HTTP requests to Fusion Middleware endpoints originating from low-privileged internal accounts targeting OPSS-managed resources.
Anomalous class loading, serialization events, or writes into directories associated with Centralized Thirdparty Jars.
New administrative or credential store changes in OPSS policies without a corresponding change management record.

Detection Strategies

Enable verbose auditing in Oracle Platform Security for Java and monitor system-jazn-data.xml and credential store modifications for unauthorized changes.
Correlate WebLogic and Fusion Middleware access logs with authentication events to detect low-privileged accounts issuing requests against administrative or third-party jar endpoints.
Baseline outbound network traffic from Fusion Middleware hosts to identify post-exploitation beaconing or lateral movement.

Monitoring Recommendations

Forward Fusion Middleware audit and access logs into a centralized SIEM for real-time correlation and long-term retention.
Alert on process creation and JVM behavior on Fusion Middleware hosts that deviates from established baselines.
Track integrity of third-party jar directories using file integrity monitoring to flag unauthorized library changes.

How to Mitigate CVE-2026-61246

Immediate Actions Required

Apply the Oracle Critical Patch Update for July 2026 to all Fusion Middleware deployments running Oracle Platform Security for Java 12.2.1.4.0 or 14.1.2.0.0.
Inventory all Fusion Middleware instances and confirm OPSS component versions before and after patching.
Restrict HTTP access to Fusion Middleware administrative and OPSS endpoints to trusted management networks.
Rotate credentials and keys stored in the OPSS credential and keystore services if compromise is suspected.

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Full patch details, download links, and prerequisite information are documented in the Oracle Security Alert - July 2026. Administrators should follow Oracle's documented patching order for Fusion Middleware to avoid regression in dependent components.

Workarounds

Limit the accounts that hold even low-privileged access to Fusion Middleware, and enforce strong authentication and network segmentation until patches are applied.
Place a reverse proxy or web application firewall in front of Fusion Middleware to filter unexpected HTTP methods and payloads against OPSS-related paths.
Disable or restrict any unused Fusion Middleware services that depend on the Centralized Thirdparty Jars component where feasible.

bash

# Configuration example: restrict access to Fusion Middleware admin endpoints at the network layer
# Replace 10.0.0.0/24 with your management network
iptables -A INPUT -p tcp --dport 7001 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP
iptables -A INPUT -p tcp --dport 7002 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7002 -j DROP