External risk intelligence

Oracle Platform Security for Java Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-60367

This vulnerability affects Oracle Fusion Middleware, a platform commonly used to host web applications, APIs, and enterprise services. Because these components frequently serve as internet-facing application layers or edge-adjacent middleware, they are commonly exposed to network-based attacks in standard deployment patterns.

Authentication Bypass

Oracle Platform Security For Java

12.2.1.4.014.1.2.0.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified within Oracle Platform Security for Java, a component of Oracle Fusion Middleware. This issue is easily exploitable by unauthenticated attackers over a network, potentially leading to a complete takeover of the affected system. The high severity score indicates significant impacts on confidentiality, integrity, and availability.

Unauthenticated attackers can compromise Oracle Platform Security for Java.
Critical exploit allows complete system takeover via network.
Confirm relevance and exposure to Oracle Fusion Middleware.

Attack Path

How an attacker could exploit the issue

An attacker could target the Oracle Platform Security for Java component within Oracle Fusion Middleware by sending network requests over HTTP. Since no authentication is required, an unauthenticated attacker can exploit this by accessing the system via the network. Successful exploitation could lead to a complete takeover of the Oracle Platform Security for Java.

Attacker gains access via network.
Vulnerable component is Centralized Thirdparty Jars.
Full system takeover is possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker with network access to compromise the Oracle Platform Security for Java component of Oracle Fusion Middleware. When supported, successful attacks could lead to a complete takeover of the affected Oracle Platform Security for Java service.

Oracle Platform Security for Java could be compromised.
Network access allows exploitation without authentication.
Complete takeover of the service is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Oracle Platform Security for Java component within Oracle Fusion Middleware is a critical target due to its easily exploitable nature, allowing unauthenticated network attackers to potentially take over the system. Real-world ownership likely falls to the platform or application teams responsible for managing Oracle Fusion Middleware, with initial steps involving inventorying affected instances, confirming network exposure, identifying business criticality, and then coordinating remediation.

Platform or application owners should address.
Verify network exposure and business criticality.
Plan remediation based on risk and impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Platform Security for Java?

It is a foundational security framework within Oracle Fusion Middleware. Developers use it to manage authentication, authorization, and data protection for Java applications. The affected component, Centralized Thirdparty Jars, provides essential libraries that support these security functions across enterprise services and web applications.

What does CVE-2026-60367 mean in plain English?

This is a critical security weakness that allows an unauthorized person to bypass security controls. Essentially, the system fails to properly validate inputs or manage library code, enabling a remote actor to gain complete control over the Oracle Platform Security for Java component. This represents a total loss of confidentiality, integrity, and availability for the affected service.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending malicious HTTP requests over a network directly to the vulnerable component. Because the flaw requires no user interaction or prior authentication, it can be initiated remotely. It is important to note that actions performed by legitimate, authenticated users within the application interface are not the source of this specific bug.

Do I need to worry if my system is internal?

According to Halo Surface Signal, this vulnerability is classified as external because Oracle Fusion Middleware frequently functions as an internet-facing application layer. If your deployment is exposed to the internet, your risk is significantly higher. Even for internal systems, you should evaluate if attackers with lateral network access could reach these middleware services.

What are the first steps to take?

Begin by identifying all servers running versions 12.2.1.4.0 or 14.1.2.0.0 of Oracle Fusion Middleware. Work with your infrastructure team to verify which instances have active network connections. Once you have an inventory, prioritize patching these systems by following the guidance provided in the official Oracle security advisory.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.