This vulnerability exists in the Centralized Thirdparty Jars component of Oracle Platform Security for Java within Oracle Fusion Middleware. It is difficult to exploit but allows a low privileged attacker with network access via HTTP to compromise the platform, potentially leading to full takeover. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not provide explicit patch or fix information for it. No known exploits in the wild have been reported.

Successful exploitation can result in complete compromise of Oracle Platform Security for Java, impacting confidentiality, integrity, and availability of the affected system. This could allow an attacker to take over the platform security component, which is critical for the security of Oracle Fusion Middleware environments.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability in its list but does not explicitly confirm patch availability or remediation steps specific to CVE-2026-60370. Customers are strongly advised to review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant security patches promptly. Until explicit patch information is confirmed, monitor Oracle advisories for updates. No vendor statement indicates that no action is required or that the vulnerability is already mitigated.