CVE-2026-60372 affects Oracle Platform Security for Java, a component of Oracle Fusion Middleware. The vulnerability is easily exploitable remotely over HTTP without authentication, enabling attackers to compromise the product and potentially take full control. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The affected versions explicitly identified are 12.2.1.4.0 and 14.1.2.0.0. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not provide direct patch links or confirm patch availability for this specific issue. Customers are urged to apply the Critical Patch Update to address this and other vulnerabilities.

Successful exploitation allows an unauthenticated attacker with network access via HTTP to fully compromise Oracle Platform Security for Java. This can lead to complete takeover of the product, impacting confidentiality, integrity, and availability of the system. The CVSS score of 9.8 underscores the critical severity and potential for significant operational disruption or data breach.

Oracle's July 2026 Critical Patch Update advisory includes security patches addressing this vulnerability as part of a broader update. Although no direct patch link is provided for CVE-2026-60372, customers should promptly apply the July 2026 Critical Patch Update to mitigate this and other vulnerabilities. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay. Patch status beyond this advisory is not explicitly confirmed; users should monitor Oracle's official security alerts for updates.