This vulnerability exists in the Oracle Platform Security for Java component of Oracle Fusion Middleware, specifically in the Centralized Thirdparty Jars component. It is easily exploitable by an attacker with low privileges and network access over HTTP, enabling compromise and potential takeover of the Oracle Platform Security for Java product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Affected versions explicitly include 12.2.1.4.0 and 14.1.2.0.0. Oracle’s July 2026 Critical Patch Update advisory references multiple patches but does not specifically confirm a fix for this CVE or provide detailed remediation instructions. Patch status is therefore not yet confirmed and should be verified with Oracle’s advisory.

Successful exploitation allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Platform Security for Java, resulting in complete takeover. This impacts confidentiality, integrity, and availability of the affected product, potentially allowing unauthorized access, data manipulation, and service disruption.

Oracle’s July 2026 Critical Patch Update advisory includes numerous security patches across products. However, it does not explicitly confirm a patch or remediation for CVE-2026-60455. Users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed and applied, no specific mitigation steps are provided by Oracle. Customers are strongly advised to remain on actively supported versions and apply security patches promptly once available.