This vulnerability exists in the Centralized Thirdparty Jars component of Oracle Platform Security for Java within Oracle Fusion Middleware. It allows an attacker with low privileges and network access over HTTP to compromise the security platform, potentially resulting in complete takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is tracked as CVE-2026-60373 and affects versions 12.2.1.4.0 and 14.1.2.0.0. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation level for these specific versions.

Successful exploitation can lead to full compromise of Oracle Platform Security for Java, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the platform security component, potentially undermining the security of dependent applications and services.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others and strongly recommends applying security patches without delay. However, the provided data does not explicitly confirm patch availability or remediation level for the affected versions 12.2.1.4.0 and 14.1.2.0.0. Therefore, users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch status and apply any relevant patches as soon as they become available. Until patches are applied, restrict network access to the affected service where possible.