CVE-2026-60164: Oracle Java SE Information Disclosure Flaw

CVE-2026-60164 Overview

CVE-2026-60164 is a vulnerability in Oracle Java SE affecting the JavaFX component. The affected supported version is Oracle Java SE 8u491. An unauthenticated attacker with network access via multiple protocols can exploit this flaw, though exploitation is difficult and requires user interaction. Successful attacks result in unauthorized read access to a subset of Oracle Java SE data. The issue applies to Java deployments that load and run untrusted code in sandboxed Java Web Start applications or sandboxed Java applets. Server deployments that only run trusted code are not affected. Oracle disclosed the issue in the Oracle Security Alert July 2026.

Critical Impact
Successful exploitation grants an unauthenticated network attacker unauthorized read access to a subset of Oracle Java SE data on client systems running sandboxed Java applications.

Affected Products

Oracle Java SE 8u491
Oracle JavaFX component
Client-side Java deployments running sandboxed Java Web Start applications or applets

Discovery Timeline

2026-07-21 - CVE-2026-60164 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60164

Vulnerability Analysis

The vulnerability resides in the JavaFX component of Oracle Java SE 8u491. It falls under [CWE-693]: Protection Mechanism Failure, indicating that the Java sandbox fails to fully enforce its intended security boundary. An attacker can reach the vulnerable code path across multiple network protocols without authentication. However, exploitation requires human interaction, such as a user opening a crafted Java Web Start application or visiting a page hosting a malicious applet. Impact is limited to confidentiality — an attacker gains partial read access to data accessible by the Java process. Integrity and availability are not affected.

Root Cause

The root cause is a weakness in the JavaFX component that allows sandboxed code to bypass an intended protection mechanism. The Java sandbox relies on layered controls to restrict what untrusted code can read. When these controls fail, code retrieved from an untrusted source can access resources that should remain isolated from the sandbox context.

Attack Vector

Exploitation targets client-side Java deployments. An attacker hosts a crafted Java Web Start application or applet on an internet-accessible resource. When a victim launches the application or renders the applet, the untrusted code executes inside the sandbox and exercises the flaw in JavaFX to read data that would otherwise be inaccessible. Server-side deployments that execute only administrator-installed trusted code are outside the exploitable attack surface.

No public proof-of-concept exploit is available for CVE-2026-60164 at this time. Refer to the Oracle Security Alert July 2026 for vendor technical details.

Detection Methods for CVE-2026-60164

Indicators of Compromise

Unexpected execution of javaws.exe or javaw.exe launching content fetched from untrusted internet domains.
Java Web Start JNLP files or applet JARs downloaded from unfamiliar hosts and referenced by browser processes.
Outbound network connections from Java client processes to previously unseen or low-reputation domains shortly after user interaction with web content.

Detection Strategies

Inventory endpoints running Oracle Java SE 8u491 and flag hosts where JavaFX is present and Java Web Start is enabled.
Build EDR rules that alert when browser processes spawn Java Web Start with JNLP arguments referencing external URLs.
Correlate user web browsing activity with subsequent Java client process file reads outside standard application directories.

Monitoring Recommendations

Log and review all executions of javaws and applet-hosting Java processes, including command-line arguments and parent process context.
Monitor egress traffic from Java client processes and alert on connections to non-corporate destinations.
Track user interaction events that precede Java client launches to identify social-engineering-driven exploitation attempts.

How to Mitigate CVE-2026-60164

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to any system running Oracle Java SE 8u491 on client endpoints.
Disable the Java browser plugin and Java Web Start on systems that do not require them.
Restrict execution of Java Web Start applications to signed applications from allowlisted publishers.

Patch Information

Oracle addressed CVE-2026-60164 in the July 2026 Critical Patch Update. Administrators should upgrade Oracle Java SE beyond version 8u491 as directed in the Oracle Security Alert July 2026. Server deployments running only trusted administrator-installed code are not affected and do not require the client-side sandbox mitigation, though patching remains recommended.

Workarounds

Configure the Java Deployment Rule Set to block execution of untrusted Java Web Start applications and applets.
Remove Java from user workstations that do not have a documented business requirement for client-side Java.
Enforce browser policies that prevent launching JNLP files from unmanaged network locations.

bash

# Example: enforce high security level and disable Java content in browser
# Windows: edit %WINDIR%\Sun\Java\Deployment\deployment.properties
deployment.security.level=VERY_HIGH
deployment.webjava.enabled=false
deployment.expiration.check.enabled=true
deployment.security.level.locked
deployment.webjava.enabled.locked