External risk intelligence

Oracle Platform Security for Java Remote Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-60369

The vulnerability affects Oracle Fusion Middleware, a platform commonly deployed to host internet-facing web applications and API services. While internal usage is possible, the product architecture is frequently used for external-facing services reachable via HTTP, making public network exposure a common deployment pattern.

Deserialization

Oracle Platform Security For Java

12.2.1.4.014.1.2.0.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Platform Security for Java, a component of Oracle Fusion Middleware. This issue, if exploited by a low-privileged attacker with network access, could lead to a complete takeover of the affected system and potentially impact other connected products. The CVSS score of 9.9 highlights the significant severity concerning confidentiality, integrity, and availability.

Unauthorized access to Oracle Platform Security.
Confirms potential for broad system compromise.
Verify relevance and exposure of affected systems.

Attack Path

How an attacker could exploit the issue

An attacker with limited privileges could reach the Oracle Platform Security for Java component of Oracle Fusion Middleware through network access. By exploiting a vulnerability in how the system handles third-party Java libraries, an attacker could gain complete control over the vulnerable component and potentially impact other connected products.

Network access via HTTP required.
Vulnerable component: Centralized Thirdparty Jars.
Risk: Takeover of the component and wider impact.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Oracle Platform Security for Java could allow a low-privileged attacker with network access to compromise the product, potentially impacting other connected Oracle Fusion Middleware products. Successful exploitation could lead to a complete takeover of the Oracle Platform Security for Java.

System data and service behavior.
Via unauthenticated HTTP network access.
Complete takeover of vulnerable systems.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Oracle Platform Security for Java within Oracle Fusion Middleware is the affected technology. This critical vulnerability, exploitable via HTTP by a low-privileged attacker, can lead to a complete takeover of the affected component and impact other products. Responsibility likely falls to the platform or application owner, with coordination from infrastructure and security teams. The first practical step involves identifying all instances of the affected technology, assessing their network reachability and business criticality, locating the accountable owner, and then prioritizing remediation efforts based on risk.

Platform or application owners should lead remediation.
Verify network exposure and business criticality first.
Plan risk-based remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Platform Security for Java?

It is a foundational component within Oracle Fusion Middleware, designed to provide consistent security services like authentication and authorization across Java-based applications. It acts as a security framework that manages how users and systems interact with enterprise applications, often relying on centralized libraries to handle core security functions.

How does CVE-2026-60369 affect the system?

This vulnerability represents a flaw in the Centralized Thirdparty Jars component. It allows an attacker to bypass standard security controls, effectively gaining unauthorized control over the security framework itself. Because this component sits at the heart of the application's security, compromising it can lead to a complete takeover of the affected system and potentially compromise other integrated products.

What triggers this vulnerability?

An attacker triggers this by sending specially crafted HTTP requests to the system. The flaw exists because the software improperly handles certain third-party Java libraries. Importantly, this does not require complex or uncommon preconditions; an attacker with standard low-level network access and basic user privileges is sufficient to initiate the attack sequence.

Why should I be concerned about CVE-2026-60369?

According to Halo Surface Signal, this vulnerability is particularly relevant because Oracle Fusion Middleware is frequently used to host internet-facing web applications and APIs. If your instances are reachable via public networks, they are accessible to remote attackers. Even if your specific deployment is internal, the high severity of a full system takeover makes it a priority for any environment running the affected versions.

What should I do first to address this?

Start by identifying every instance of Oracle Fusion Middleware in your environment. Confirm which versions you are running and determine their network reachability. Once you have an inventory, coordinate with the application owners to assess the business impact of these systems. This groundwork allows you to prioritize your response efforts based on which servers are most exposed or critical to your operations.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.