Oracle PLF Java RCE via Centralized Thirdparty Jars (12.2.1.4.0/14.1.2.0.0)
CVE-2026-60371 Published on July 22, 2026
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Platform Security for Java executes to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Security for Java, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
Vulnerability Analysis
Weakness Types
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2026-60371 has been classified to as an Authorization vulnerability or weakness.
Improper Privilege Management
The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
What is an Information Disclosure Vulnerability?
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVE-2026-60371 has been classified to as an Information Disclosure vulnerability or weakness.
Products Associated with CVE-2026-60371
stack.watch emails you whenever new vulnerabilities are published in Oracle or Oracle Platform Security For Java. Just hit a watch button to start following.
Affected Versions
Oracle Corporation Oracle Platform Security for Java:- Version 12.2.1.4.0 is affected.
- Version 14.1.2.0.0 is affected.