Skip to main content
A Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection. Six years running.Find Out Why
CVE Vulnerability Database
Vulnerability Database/CVE-2026-62574

CVE-2026-62574: Oracle Java SE Privilege Escalation Flaw

CVE-2026-62574 is a privilege escalation vulnerability in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition. Low privileged attackers can achieve complete system takeover. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

Published:

CVE-2026-62574 Overview

CVE-2026-62574 is a high-severity vulnerability in the Install component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. The flaw allows a low-privileged attacker with local logon access to the infrastructure where the affected runtime executes to fully compromise the product. Successful exploitation results in complete takeover of the Java SE or GraalVM installation, with high impact to confidentiality, integrity, and availability. The vulnerability is classified under CWE-284: Improper Access Control and was published in Oracle's July 2026 Critical Patch Update.

Critical Impact

Local, low-privileged attackers can achieve full takeover of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition installations without user interaction.

Affected Products

  • Oracle Java SE versions 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, and 26.0.1
  • Oracle GraalVM for JDK versions 17.0.19 and 21.0.11
  • Oracle GraalVM Enterprise Edition version 21.3.18

Discovery Timeline

Technical Details for CVE-2026-62574

Vulnerability Analysis

The vulnerability resides in the Install component of Oracle Java SE and GraalVM distributions. Oracle's advisory classifies the flaw as easily exploitable, requiring only local access and low privileges. No user interaction is required, and the attack scope remains unchanged, meaning the impact is contained to the vulnerable component but yields full compromise of that component.

All three impact metrics — confidentiality, integrity, and availability — are rated high. An attacker who exploits this issue can read, modify, or destroy data managed by the affected Java runtime and take over its execution environment. Because the Install component runs with elevated privileges during setup or update operations, successful exploitation typically yields the privileges of that process.

Root Cause

The root cause is improper access control [CWE-284] within the installer logic of Oracle Java SE and GraalVM. The Install component fails to correctly enforce boundaries between low-privileged local users and privileged installation operations, allowing an unprivileged user to influence installer behavior on the host.

Attack Vector

The attack vector is local. An attacker must first authenticate to the system where the affected Oracle Java SE or GraalVM binary executes. From that foothold, the attacker abuses the Install component to escalate control over the Java runtime environment. Oracle has not published exploitation details beyond the advisory, and no public proof-of-concept is currently available.

The vulnerability manifests within the Install component's privileged operations. Refer to the Oracle Security Alert July 2026 for vendor-provided technical details.

Detection Methods for CVE-2026-62574

Indicators of Compromise

  • Unexpected invocations of the Java or GraalVM installer binaries by non-administrative user accounts
  • New or modified files under Java or GraalVM installation directories outside of scheduled patch windows
  • Elevation of privilege events correlated with installer or updater processes on hosts running affected versions

Detection Strategies

  • Inventory endpoints and servers running the affected versions of Oracle Java SE (8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1), Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition
  • Audit local process execution telemetry for installer components spawned by unprivileged users
  • Correlate file integrity monitoring alerts on jre, jdk, and GraalVM directories with authentication logs

Monitoring Recommendations

  • Enable command-line and process ancestry logging on hosts running affected Java runtimes
  • Forward endpoint telemetry to a central data lake to hunt for anomalous installer activity across the fleet
  • Monitor for unexpected privilege transitions initiated by users who do not typically perform administrative tasks

How to Mitigate CVE-2026-62574

Immediate Actions Required

  • Apply the fixes from the Oracle July 2026 Critical Patch Update to all affected Java SE and GraalVM installations
  • Restrict local logon rights on servers running Oracle Java SE and GraalVM to trusted administrators only
  • Enforce least-privilege permissions on Java and GraalVM installation directories to prevent tampering by standard users

Patch Information

Oracle addressed CVE-2026-62574 in the July 2026 Critical Patch Update. Administrators should upgrade Oracle Java SE beyond versions 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, and 26.0.1, upgrade Oracle GraalVM for JDK beyond 17.0.19 and 21.0.11, and upgrade Oracle GraalVM Enterprise Edition beyond 21.3.18. Consult the vendor advisory for the exact fixed release identifiers applicable to each product line.

Workarounds

  • Limit interactive and remote local logon sessions on systems hosting the affected Java or GraalVM runtimes
  • Remove or disable unused Java SE and GraalVM installations to reduce the attack surface
  • Apply operating system access controls to prevent standard users from invoking installer or updater components

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Default Legacy - Prefooter | Experience the World’s Most Advanced Cybersecurity Platform

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne