This vulnerability affects Oracle Platform Security for Java, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely over HTTP by an attacker with low privileges, enabling compromise of the platform security component. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is listed in Oracle's July 2026 Critical Patch Update advisory, which bundles numerous patches across Oracle products. However, the advisory does not explicitly confirm a patch or workaround for this vulnerability, nor does it provide specific remediation instructions.

Successful exploitation can lead to complete takeover of Oracle Platform Security for Java, affecting confidentiality, integrity, and availability of the system. This could allow attackers to gain unauthorized control over security functions within the Oracle Fusion Middleware environment.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others but does not explicitly confirm patch availability or provide specific remediation instructions for CVE-2026-60373. Therefore, patch status is not yet confirmed—users should consult the Oracle advisory directly for the latest remediation guidance and apply any relevant patches promptly once available. Oracle strongly recommends applying security patches without delay to mitigate exploitation risks.