CVE-2026-60147 Overview
CVE-2026-60147 is a network-exploitable vulnerability in the Security component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. An unauthenticated attacker with network access via multiple protocols can compromise affected installations. Successful exploitation grants unauthorized update, insert, or delete access to a subset of accessible data, along with unauthorized read access to a subset of data. The flaw is categorized under [CWE-284] Improper Access Control. Oracle disclosed the issue in the Oracle Security Alert July 2026.
Critical Impact
The vulnerability applies to Java deployments running sandboxed Java Web Start applications or applets that load untrusted code and rely on the Java sandbox for security, as well as server-side APIs consumed by web services.
Affected Products
- Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1
- Oracle GraalVM for JDK: 17.0.19 and 21.0.11
- Oracle GraalVM Enterprise Edition: 21.3.18
Discovery Timeline
- 2026-07-21 - CVE CVE-2026-60147 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60147
Vulnerability Analysis
The vulnerability resides in the Security component of Oracle Java SE and Oracle GraalVM distributions. It is classified under [CWE-284] Improper Access Control, indicating that the runtime fails to enforce restrictions on operations that should be limited to trusted callers. An attacker can reach the vulnerable logic over the network using multiple protocols without prior authentication or user interaction. Exploitation results in partial confidentiality and integrity impact but no availability impact. The EPSS probability for this CVE is 0.269%, reflecting current exploitation likelihood observed in the wild.
Root Cause
The defect lies in the access control logic within the Security component of the Java runtime. The runtime does not sufficiently constrain operations invoked from untrusted contexts, allowing sandboxed or remote callers to reach code paths that should be inaccessible. This weakness allows attackers to bypass intended security boundaries between trusted and untrusted code.
Attack Vector
Two exploitation scenarios apply. First, server-side attackers can supply crafted data to APIs in the Security component through a web service that forwards data to the vulnerable APIs. Second, client-side attackers can exploit the flaw through sandboxed Java Web Start applications or sandboxed Java applets that load untrusted code from the internet. In both cases, exploitation requires no privileges and no user interaction.
No verified public proof-of-concept code is available at this time. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical details.
Detection Methods for CVE-2026-60147
Indicators of Compromise
- Unexpected outbound connections initiated by Java processes (java.exe, java) following the loading of remote applets or Java Web Start applications.
- Anomalous file, registry, or data-store modifications performed by JVM processes running with elevated privileges.
- Web service access logs showing malformed or unexpected payloads directed at endpoints that pass data into Java Security component APIs.
Detection Strategies
- Inventory all systems running affected Oracle Java SE and GraalVM versions using software asset management or endpoint telemetry.
- Monitor JVM child process creation and script interpreter spawning that deviates from baseline application behavior.
- Correlate web application logs with backend JVM activity to identify anomalous API calls to security-sensitive components.
Monitoring Recommendations
- Enable and centralize Java Flight Recorder or equivalent JVM audit logs for security-relevant events.
- Alert on execution of javaws and browser-invoked applet loads from untrusted network zones.
- Track patch state of JRE and JDK installations across managed endpoints and servers.
How to Mitigate CVE-2026-60147
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all affected Java SE and GraalVM installations.
- Disable Java Web Start and browser applet support on user endpoints where business requirements do not mandate them.
- Restrict outbound network access from server-side JVMs to only required destinations to limit exploitation reach.
Patch Information
Oracle addressed CVE-2026-60147 in the July 2026 Critical Patch Update. Upgrade to the fixed releases listed in the Oracle Security Alert July 2026. Affected versions include Oracle Java SE 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, and 26.0.1; Oracle GraalVM for JDK 17.0.19 and 21.0.11; and Oracle GraalVM Enterprise Edition 21.3.18.
Workarounds
- Remove or disable the Java browser plugin and javaws on systems that do not require sandboxed applet execution.
- Enforce strict input validation and authentication on any web service that forwards user-supplied data to Java Security component APIs.
- Segment server-side Java workloads and apply egress firewall rules to block untrusted inbound protocol traffic.
# Verify installed Java version and confirm patch level
java -version
# Disable Java Web Start on Linux by removing the launcher symlink
sudo rm -f /usr/bin/javaws
# On Windows, uninstall vulnerable JRE versions via winget
winget uninstall Oracle.JavaRuntimeEnvironment
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
