This vulnerability affects Oracle Platform Security for Java, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely over the network via SOAP by an attacker with low privileges and no user interaction required. Successful exploitation can lead to complete compromise of the Oracle Platform Security for Java component. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory is a general Critical Patch Update notice listing many patched products but does not explicitly confirm a patch for this vulnerability in the provided excerpt.

An attacker with network access and low privileges can exploit this vulnerability via SOAP to fully compromise Oracle Platform Security for Java. This results in high impact on confidentiality, integrity, and availability of the affected system, potentially allowing full takeover of the security platform component.

The Oracle Critical Patch Update advisory for July 2026 references this vulnerability among many others. However, the provided advisory content does not explicitly confirm the availability of a patch for CVE-2026-60368. Customers are strongly advised to review the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply all relevant patches promptly. Until a patch is confirmed and applied, limit network access to the affected Oracle Platform Security for Java SOAP interfaces to trusted users only.