Cyber Resilience

CVE-2026-60367

RCE in Oracle Platform Security For Java 12.2.1.4.0 … 14.1.2.0.0

Published
22 July 2026
Modified
24 July 2026
Patch / advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0032 24th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-60367 is a critical-severity Improper Privilege Management (CWE-269) vulnerability in Oracle Platform Security For Java. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and IA-2 (Identification and Authentication (Organizational Users)) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…

more

Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Unauthenticated remote HTTP access to compromise a public-facing middleware component (CWE-287/306/502) directly enables initial access via exploitation of a public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-60373Same product: Oracle Platform Security For Java
CVE-2026-61246Same product: Oracle Platform Security For Java
CVE-2026-60366Same product: Oracle Platform Security For Java
CVE-2026-60372Same product: Oracle Platform Security For Java
CVE-2026-60439Same product: Oracle Platform Security For Java
CVE-2026-60455Same product: Oracle Platform Security For Java
CVE-2026-60369Same product: Oracle Platform Security For Java
CVE-2026-60371Same product: Oracle Platform Security For Java
CVE-2026-46817Same vendor: Oracle
CVE-2026-62464Same vendor: Oracle

Affected Assets

oracle
platform security for java
12.2.1.4.0, 14.1.2.0.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • IA-2 Identification and Authentication (Organizational Users)
  • SI-10 Information Input Validation
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 19 hardening rules · 10 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V6.4.4
  • V6.5.4
  • V6.5.5
  • V6.5.7

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces authentication and authorization checks before permitting any access to Oracle Platform Security for Java functions, blocking the unauthenticated HTTP takeover path.

prevent

Mandates identification and authentication of all network users prior to granting access, directly mitigating the missing authentication weakness (CWE-287/306).

prevent

Requires validation of all input data, which would block exploitation via deserialization of untrusted data (CWE-502) that leads to privilege escalation and system takeover.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-03 full match
prevents

Directly requires authentication of users/services/hardware, which eliminates missing authentication for critical functions.

PR.AA-04 mostly match
prevents

PR.AA-04 directly enables verification of identity assertions (mostly preventing CWE-287 in that scope) yet leaves many other authentication failure modes unaddressed (only partial prevention overall).

PR.AA-05 mostly match
prevents

PR.AA-05 enforces least privilege/SoD and periodic reviews that directly remove most privilege-assignment defects, yet CWE-269 also covers escalation paths and role design outside a single access-management control.

PR.AA-01 partial match
prevents

PR.AA-01 supplies credential/identity lifecycle support that can reduce some privilege-assignment errors but does not itself assign, modify, or check privileges, leaving most of CWE-269's risk unaddressed.

PR.AA-02 partial match
prevents

PR.AA-02 ensures valid enrollment and unique credential binding, which reduces some improper-auth risks at issuance time but leaves runtime claim verification untouched, so each direction only partially addresses the other.

PR.IR-01 partial match
prevents

Protecting networks from unauthorized access can be undermined by missing authentication but does not address the root authentication gap.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Requiring authentication methods whose strength matches the sensitivity of the data and mandating multi-factor authentication directly blocks attempts to access resources without proving identity.

prevents

Verifying user identity before issuing replacement credentials and forcing changes after compromise reduces the likelihood that authentication bypass can be achieved through stolen or weak credentials.

prevents

Requiring owner approval, segregation of duties, and periodic reviews prevents the assignment of excessive or unnecessary privileges to users or processes.

prevents

Enforcing minimum-necessary privileges, temporary grants, and separation of administrative versus normal identities prevents the over-assignment of rights that CWE-269 describes.

detects

Security testing includes validation of deserialization routines and the use of untrusted data, reducing the likelihood that unsafe object reconstruction will be deployed.

prevents

Dynamic techniques that grant the minimum necessary rights for a given time window and revoke them afterward reduce the window in which excessive or unnecessary privileges can be exploited.

References