# CVE-2026-60371: Oracle Platform Security for Java compromise in Centralized Thirdparty Jars

Source: https://junglewise.ai/threats/cve-2026-60371-oracle-platform-security-for-java-compromise-in-centralized  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-22. Updated: 2026-07-22  
License: CC BY 4.0 with a link back

CVE-2026-60371 · Severity: high · CVSS 8 · Published 2026-07-22

Oracle Platform Security for Java, a component of Oracle Fusion Middleware used for managing security across Java applications, contains a high-severity vulnerability. An attacker with low-level access to the same local network segment as the affected hardware could potentially take full control of the security platform. This could lead to a total compromise of the system's confidentiality and integrity, potentially impacting other connected business applications.

Technologies: [Oracle Platform Security for Java](https://junglewise.ai/threats/technologies/platform-security-for-java). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-60371 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-60371 being exploited in the wild.

**How severe is CVE-2026-60371?** High severity, with a CVSS score of 8, published 22 July 2026.

**Which products and versions are affected?** Oracle Platform Security for Java 12.2.1.4.0, 14.1.2.0.0.

**Is there a fix for CVE-2026-60371?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-60371 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-60371?** Check whether you run Oracle Platform Security for Java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability exists in the Centralized Thirdparty Jars component of Oracle Platform Security for Java (versions 12.2.1.4.0 and 14.1.2.0.0). It is classified as difficult to exploit (AC:H) and requires the attacker to have low-privileged access (PR:L) to the physical communication segment (AV:A) attached to the target hardware. Successful exploitation results in a scope change (S:C), meaning the attacker can potentially impact other products beyond the security platform itself, leading to a complete takeover of the affected component. The vulnerability was disclosed as part of the Oracle Critical Patch Update for July 2026.

## Affected products

- Oracle Platform Security for Java 12.2.1.4.0, 14.1.2.0.0

## Timeline

- 2026-07-22: disclosed: Initial publication of CVE-2026-60371
- 2026-07-22: advisory: Included in Oracle Critical Patch Update (CPU) July 2026

## References

- [https://www.oracle.com/security-alerts/cpujul2026.html](https://www.oracle.com/security-alerts/cpujul2026.html)

## Related threats

- [Oracle Platform Security for Java remote code execution](https://junglewise.ai/threats/cve-2026-83020-oracle-platform-security-for-java-remote-code-execution)
- [Oracle Platform Security for Java remote code execution in Centralized Thirdparty Jars](https://junglewise.ai/threats/cve-2026-83011-oracle-platform-security-for-java-remote-code-execution-in)
- [Oracle Platform Security for Java privilege escalation](https://junglewise.ai/threats/cve-2026-82996-oracle-platform-security-for-java-privilege-escalation)
- [Oracle Platform Security for Java remote code execution in Centralized Thirdparty Jars](https://junglewise.ai/threats/cve-2026-82995-oracle-platform-security-for-java-remote-code-execution-in)
- [Oracle Platform Security for Java remote code execution in LDAP](https://junglewise.ai/threats/cve-2026-82994-oracle-platform-security-for-java-remote-code-execution-in-ldap)