CVE-2026-60166: Oracle Java SE Information Disclosure Flaw

CVE-2026-60166 is an information disclosure vulnerability in Oracle Java SE's JavaFX component affecting version 8u491. Attackers can gain unauthorized read access to data in sandboxed environments. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-60166 Overview

CVE-2026-60166 is a low-severity vulnerability in Oracle Java SE version 8u491, specifically within the JavaFX component. The flaw allows an unauthenticated remote attacker to compromise confidentiality of a subset of Java SE data. Exploitation requires user interaction and high attack complexity, limiting practical attack scenarios.

The vulnerability affects Java deployments that load and run untrusted code, such as sandboxed Java Web Start applications and sandboxed Java applets. Server-side deployments running only trusted code are not impacted. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation grants unauthorized read access to a subset of Oracle Java SE accessible data, resulting in limited information disclosure without integrity or availability impact.

Affected Products

Oracle Java SE 8u491 (JavaFX component)
Java Web Start sandboxed applications on affected versions
Java applet deployments relying on the Java sandbox for security

Discovery Timeline

2026-07-21 - CVE-2026-60166 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60166

Vulnerability Analysis

The vulnerability resides in the JavaFX component of Oracle Java SE 8u491. It is categorized under [CWE-693] Protection Mechanism Failure, indicating that a security control intended to isolate untrusted code fails to enforce its boundary correctly. Attackers can leverage this weakness to read data that should remain isolated within the Java sandbox.

The attack surface is limited to client-side Java deployments that execute untrusted code retrieved from remote sources. The impact is confined to confidentiality, with no modification or denial-of-service potential according to the published metrics.

Exploitation requires the victim to interact with attacker-controlled content, such as visiting a page hosting a malicious Java applet or launching a crafted Java Web Start application. The high attack complexity indicates that specific runtime conditions must be satisfied for the exploit to succeed.

Root Cause

The root cause is a protection mechanism failure within JavaFX that permits sandboxed code to access a limited subset of data outside its intended boundary. The Java sandbox is designed to isolate untrusted code, and this flaw undermines that isolation for specific data paths handled by JavaFX.

Attack Vector

The attacker delivers malicious Java content over the network using multiple protocols. When the victim executes the untrusted applet or Web Start application, the flawed protection mechanism in JavaFX allows the code to read restricted data. No authentication is required, but user interaction is mandatory.

No verified proof-of-concept code is publicly available for this issue. Refer to the Oracle Security Alert July 2026 for authoritative technical detail.

Detection Methods for CVE-2026-60166

Indicators of Compromise

Unexpected execution of javaws.exe or javaw.exe processes launching content from untrusted network sources
JNLP files downloaded from unknown origins and executed by end users
Browser or client processes spawning Java runtime with references to remote .jar or .jnlp resources

Detection Strategies

Inventory endpoints running Oracle Java SE 8u491 and flag any client-side deployments still using Java Web Start or applets
Monitor process execution telemetry for Java runtime invocations that load remote code
Correlate outbound network connections from Java processes with unapproved domains

Monitoring Recommendations

Log all Java runtime executions and JNLP handler invocations across managed endpoints
Track user-initiated launches of applets and Web Start applications through browser and OS event logs
Alert on Java processes reading sensitive user directories following remote content execution

How to Mitigate CVE-2026-60166

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all affected Java SE 8 installations
Uninstall Oracle Java SE from endpoints that do not require it, particularly workstations without a documented business need
Disable the Java browser plugin and Java Web Start on client systems where possible

Patch Information

Oracle addressed this vulnerability in the Oracle Security Alert July 2026. Administrators should upgrade Java SE 8 beyond update 8u491 to the fixed release identified in that advisory.

Workarounds

Restrict execution of Java applets and Web Start applications through application allowlisting
Configure the Java Control Panel security level to block untrusted content and require signed code
Use browser and endpoint policy to prevent handling of .jnlp files from untrusted zones

bash

# Configuration example: disable Java Web Start file association on Windows
assoc .jnlp=
ftype JNLPFile=