CVE-2026-60589: Oracle Java SE Information Disclosure Flaw

CVE-2026-60589 Overview

CVE-2026-60589 is an information disclosure vulnerability in the Security component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. An unauthenticated attacker with network access can exploit the flaw across multiple protocols to gain unauthorized read access to a subset of data. Exploitation is difficult and requires supplying data to APIs in the Security component, such as through a web service. Untrusted Java Web Start applications and untrusted Java applets are not viable attack surfaces. The weakness is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
Successful exploitation grants unauthorized read access to a limited subset of data processed by the Security component in affected Oracle Java SE and GraalVM builds.

Affected Products

Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2
Oracle GraalVM for JDK: 17.0.20 and 21.0.12
Oracle GraalVM Enterprise Edition: 21.3.19

Discovery Timeline

2026-08-18 - CVE-2026-60589 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60589

Vulnerability Analysis

The vulnerability resides in the Security component shared by Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. An attacker interacts with vulnerable APIs over the network, typically through a service that forwards attacker-supplied input to the affected Security routines. Successful exploitation yields partial confidentiality impact only. Integrity and availability of the target runtime remain intact. The issue maps to CWE-200, reflecting information exposure rather than code execution or corruption. Public exploit code is not available, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Root Cause

Oracle's advisory attributes the flaw to the Security component but does not publish the specific class, method, or code path. The Security component provides cryptographic services, certificate handling, and access control primitives used across the JDK. The condition allows attacker-controlled input processed by these APIs to leak a subset of runtime-accessible data. Difficult exploitation conditions indicate that specific input crafting, timing, or environmental state is required to trigger the disclosure.

Attack Vector

Exploitation requires network access and no authentication. The attacker delivers crafted data to a service that invokes affected Security component APIs on the JVM. Web services, RPC endpoints, and custom protocol handlers that accept untrusted input and pass it to Security APIs are all in scope. Untrusted Java Web Start applications and untrusted Java applets are explicitly excluded as attack channels. The Oracle Security Alert is the authoritative source for scope and remediation guidance.

Detection Methods for CVE-2026-60589

Indicators of Compromise

No file-based indicators, malware hashes, or network signatures have been published for CVE-2026-60589.
Unusual volumes of malformed cryptographic or certificate-parsing input directed at Java-based web services may indicate probing.
Repeated exceptions originating from java.security or related packages in application logs can precede successful exploitation.

Detection Strategies

Inventory all deployed JDK and GraalVM runtimes and cross-reference version strings against the affected versions listed in the Oracle Security Alert.
Instrument web services and RPC endpoints that accept externally supplied cryptographic material, certificates, or signed payloads for anomalous parsing errors.
Correlate JVM runtime telemetry with network traffic to identify unauthenticated requests reaching Security component APIs.

Monitoring Recommendations

Forward application, JVM, and reverse proxy logs to a centralized analytics platform for cross-source correlation.
Alert on repeated SecurityException, CertificateException, or unusual KeyStore access patterns generated by internet-facing Java services.
Track outbound data volume from Java application processes to detect exfiltration following successful information disclosure.

How to Mitigate CVE-2026-60589

Immediate Actions Required

Apply the security updates referenced in the Oracle Security Alert to all affected Java SE and GraalVM installations.
Prioritize patching of internet-exposed services that accept untrusted input and invoke Security component APIs.
Restrict network exposure of Java-based web services to trusted networks where operationally feasible.

Patch Information

Oracle addressed CVE-2026-60589 in the August 2026 security advisory. Administrators should upgrade Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition to the fixed releases documented in the Oracle Security Alert. Deploy patches to development, test, and production runtimes because both server and client JVMs are in scope.

Workarounds

Place a validating proxy or web application firewall in front of services that pass untrusted input into Java Security APIs.
Enforce strict input validation on cryptographic parameters, certificates, and signed payloads before they reach the JVM.
Segment vulnerable Java workloads on isolated network zones until patches are fully deployed.

bash

# Verify installed Java version against fixed releases
java -version

# Example inventory command across Linux hosts
find / -name "java" -type f 2>/dev/null -exec {} -version \;