Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-62574 (GCVE-0-2026-62574)
Vulnerability from cvelistv5 – Published: 2026-07-21 21:39 – Updated: 2026-07-22 13:09
VLAI
EPSS
VEX
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.oracle.com/security-alerts/cpujul2026.html | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Oracle Corporation | Oracle Java SE |
Affected:
8u491
Affected: 11.0.31 Affected: 17.0.19 Affected: 21.0.11 Affected: 25.0.3 Affected: 26.0.1 |
|
| Oracle Corporation | Oracle GraalVM for JDK |
Affected:
17.0.19
Affected: 21.0.11 |
|
| Oracle Corporation | Oracle GraalVM Enterprise Edition |
Affected:
21.3.18
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62574",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T13:09:05.278980Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T13:09:19.240Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Oracle Java SE",
"vendor": "Oracle Corporation",
"versions": [
{
"status": "affected",
"version": "8u491"
},
{
"status": "affected",
"version": "11.0.31"
},
{
"status": "affected",
"version": "17.0.19"
},
{
"status": "affected",
"version": "21.0.11"
},
{
"status": "affected",
"version": "25.0.3"
},
{
"status": "affected",
"version": "26.0.1"
}
]
},
{
"product": "Oracle GraalVM for JDK",
"vendor": "Oracle Corporation",
"versions": [
{
"status": "affected",
"version": "17.0.19"
},
{
"status": "affected",
"version": "21.0.11"
}
]
},
{
"product": "Oracle GraalVM Enterprise Edition",
"vendor": "Oracle Corporation",
"versions": [
{
"status": "affected",
"version": "21.3.18"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oracle:java_se:8u491:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:java_se:11.0.31:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:java_se:17.0.19:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:java_se:21.0.11:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:java_se:25.0.3:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:java_se:26.0.1:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.19:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.11:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:graalvm:21.3.18:*:*:*:enterprise:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en-US",
"value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.",
"lang": "en-US"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T21:39:51.149Z",
"orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
"shortName": "oracle"
},
"references": [
{
"name": "Oracle Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://www.oracle.com/security-alerts/cpujul2026.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
"assignerShortName": "oracle",
"cveId": "CVE-2026-62574",
"datePublished": "2026-07-21T21:39:51.149Z",
"dateReserved": "2026-07-14T14:54:48.742Z",
"dateUpdated": "2026-07-22T13:09:19.240Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-62574",
"date": "2026-07-24",
"epss": "0.00099",
"percentile": "0.00953"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-62574\",\"sourceIdentifier\":\"secalert_us@oracle.com\",\"published\":\"2026-07-21T22:19:09.667\",\"lastModified\":\"2026-07-23T18:29:34.653\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\"}],\"affected\":[{\"source\":\"secalert_us@oracle.com\",\"affectedData\":[{\"vendor\":\"Oracle Corporation\",\"product\":\"Oracle Java SE\",\"versions\":[{\"version\":\"8u491\",\"status\":\"affected\"},{\"version\":\"11.0.31\",\"status\":\"affected\"},{\"version\":\"17.0.19\",\"status\":\"affected\"},{\"version\":\"21.0.11\",\"status\":\"affected\"},{\"version\":\"25.0.3\",\"status\":\"affected\"},{\"version\":\"26.0.1\",\"status\":\"affected\"}]},{\"vendor\":\"Oracle Corporation\",\"product\":\"Oracle GraalVM for JDK\",\"versions\":[{\"version\":\"17.0.19\",\"status\":\"affected\"},{\"version\":\"21.0.11\",\"status\":\"affected\"}]},{\"vendor\":\"Oracle Corporation\",\"product\":\"Oracle GraalVM Enterprise Edition\",\"versions\":[{\"version\":\"21.3.18\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert_us@oracle.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-22T13:09:05.278980Z\",\"id\":\"CVE-2026-62574\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"}]}],\"references\":[{\"url\":\"https://www.oracle.com/security-alerts/cpujul2026.html\",\"source\":\"secalert_us@oracle.com\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-62574\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-22T13:09:05.278980Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-284\", \"description\": \"CWE-284 Improper Access Control\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-22T13:09:15.585Z\"}}], \"cna\": {\"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"Oracle Corporation\", \"product\": \"Oracle Java SE\", \"versions\": [{\"status\": \"affected\", \"version\": \"8u491\"}, {\"status\": \"affected\", \"version\": \"11.0.31\"}, {\"status\": \"affected\", \"version\": \"17.0.19\"}, {\"status\": \"affected\", \"version\": \"21.0.11\"}, {\"status\": \"affected\", \"version\": \"25.0.3\"}, {\"status\": \"affected\", \"version\": \"26.0.1\"}]}, {\"vendor\": \"Oracle Corporation\", \"product\": \"Oracle GraalVM for JDK\", \"versions\": [{\"status\": \"affected\", \"version\": \"17.0.19\"}, {\"status\": \"affected\", \"version\": \"21.0.11\"}]}, {\"vendor\": \"Oracle Corporation\", \"product\": \"Oracle GraalVM Enterprise Edition\", \"versions\": [{\"status\": \"affected\", \"version\": \"21.3.18\"}]}], \"references\": [{\"url\": \"https://www.oracle.com/security-alerts/cpujul2026.html\", \"name\": \"Oracle Advisory\", \"tags\": [\"vendor-advisory\"]}], \"descriptions\": [{\"lang\": \"en-US\", \"value\": \"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en-US\", \"description\": \"Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:oracle:java_se:8u491:*:*:*:*:*:*:*\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:oracle:java_se:11.0.31:*:*:*:*:*:*:*\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:oracle:java_se:17.0.19:*:*:*:*:*:*:*\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:oracle:java_se:21.0.11:*:*:*:*:*:*:*\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:oracle:java_se:25.0.3:*:*:*:*:*:*:*\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:oracle:java_se:26.0.1:*:*:*:*:*:*:*\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:oracle:graalvm_for_jdk:17.0.19:*:*:*:*:*:*:*\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:oracle:graalvm_for_jdk:21.0.11:*:*:*:*:*:*:*\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:oracle:graalvm:21.3.18:*:*:*:enterprise:*:*:*\", \"vulnerable\": true}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"43595867-4340-4103-b7a2-9a5208d29a85\", \"shortName\": \"oracle\", \"dateUpdated\": \"2026-07-21T21:39:51.149Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-62574\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-22T13:09:19.240Z\", \"dateReserved\": \"2026-07-14T14:54:48.742Z\", \"assignerOrgId\": \"43595867-4340-4103-b7a2-9a5208d29a85\", \"datePublished\": \"2026-07-21T21:39:51.149Z\", \"assignerShortName\": \"oracle\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
CERTFR-2026-AVI-0915
Vulnerability from certfr_avis - Published: 2026-07-23 - Updated: 2026-07-23
De multiples vulnérabilités ont été découvertes dans Oracle Java SE. Elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Oracle | Java SE | Oracle Java SE version 25.0.3 | ||
| Oracle | Java SE | Oracle Java SE version 8u491 | ||
| Oracle | Java SE | Oracle Java SE version 21.0.11 | ||
| Oracle | Java SE | Oracle Java SE version 8u491-perf | ||
| Oracle | Java SE | Oracle Java SE version 17.0.19 | ||
| Oracle | Java SE | Oracle GraalVM for JDK version 21.0.11 | ||
| Oracle | Java SE | Oracle Java SE version 11.0.31 | ||
| Oracle | Java SE | Oracle GraalVM for JDK version 17.0.19 | ||
| Oracle | Java SE | Oracle GraalVM Enterprise Edition version 21.3.18 | ||
| Oracle | Java SE | Oracle Java SE version 26.0.1 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Oracle Java SE version 25.0.3",
"product": {
"name": "Java SE",
"vendor": {
"name": "Oracle",
"scada": false
}
}
},
{
"description": "Oracle Java SE version 8u491",
"product": {
"name": "Java SE",
"vendor": {
"name": "Oracle",
"scada": false
}
}
},
{
"description": "Oracle Java SE version 21.0.11",
"product": {
"name": "Java SE",
"vendor": {
"name": "Oracle",
"scada": false
}
}
},
{
"description": "Oracle Java SE version 8u491-perf",
"product": {
"name": "Java SE",
"vendor": {
"name": "Oracle",
"scada": false
}
}
},
{
"description": "Oracle Java SE version 17.0.19",
"product": {
"name": "Java SE",
"vendor": {
"name": "Oracle",
"scada": false
}
}
},
{
"description": "Oracle GraalVM for JDK version 21.0.11",
"product": {
"name": "Java SE",
"vendor": {
"name": "Oracle",
"scada": false
}
}
},
{
"description": "Oracle Java SE version 11.0.31",
"product": {
"name": "Java SE",
"vendor": {
"name": "Oracle",
"scada": false
}
}
},
{
"description": "Oracle GraalVM for JDK version 17.0.19",
"product": {
"name": "Java SE",
"vendor": {
"name": "Oracle",
"scada": false
}
}
},
{
"description": "Oracle GraalVM Enterprise Edition version 21.3.18",
"product": {
"name": "Java SE",
"vendor": {
"name": "Oracle",
"scada": false
}
}
},
{
"description": "Oracle Java SE version 26.0.1",
"product": {
"name": "Java SE",
"vendor": {
"name": "Oracle",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-41254",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41254"
},
{
"name": "CVE-2026-47010",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47010"
},
{
"name": "CVE-2026-47057",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47057"
},
{
"name": "CVE-2026-62574",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62574"
},
{
"name": "CVE-2026-47013",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47013"
},
{
"name": "CVE-2026-47034",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47034"
},
{
"name": "CVE-2026-47027",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47027"
},
{
"name": "CVE-2026-47058",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47058"
},
{
"name": "CVE-2026-47035",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47035"
},
{
"name": "CVE-2026-60526",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-60526"
},
{
"name": "CVE-2026-47030",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47030"
},
{
"name": "CVE-2026-47063",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47063"
},
{
"name": "CVE-2026-47021",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47021"
},
{
"name": "CVE-2026-60164",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-60164"
},
{
"name": "CVE-2026-46968",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46968"
},
{
"name": "CVE-2026-60166",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-60166"
},
{
"name": "CVE-2026-46917",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46917"
},
{
"name": "CVE-2026-60147",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-60147"
},
{
"name": "CVE-2026-47059",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47059"
}
],
"initial_release_date": "2026-07-23T00:00:00",
"last_revision_date": "2026-07-23T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0915",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-07-23T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Oracle Java SE. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Oracle Java SE",
"vendor_advisories": [
{
"published_at": "2026-07-21",
"title": "Bulletin de s\u00e9curit\u00e9 Oracle Java SE cpujul2026",
"url": "https://www.oracle.com/security-alerts/cpujul2026.html"
}
]
}
FKIE_CVE-2026-62574
Vulnerability from fkie_nvd - Published: 2026-07-21 22:19 - Updated: 2026-07-23 18:29
Severity
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
References
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"product": "Oracle Java SE",
"vendor": "Oracle Corporation",
"versions": [
{
"status": "affected",
"version": "8u491"
},
{
"status": "affected",
"version": "11.0.31"
},
{
"status": "affected",
"version": "17.0.19"
},
{
"status": "affected",
"version": "21.0.11"
},
{
"status": "affected",
"version": "25.0.3"
},
{
"status": "affected",
"version": "26.0.1"
}
]
},
{
"product": "Oracle GraalVM for JDK",
"vendor": "Oracle Corporation",
"versions": [
{
"status": "affected",
"version": "17.0.19"
},
{
"status": "affected",
"version": "21.0.11"
}
]
},
{
"product": "Oracle GraalVM Enterprise Edition",
"vendor": "Oracle Corporation",
"versions": [
{
"status": "affected",
"version": "21.3.18"
}
]
}
],
"source": "secalert_us@oracle.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."
}
],
"id": "CVE-2026-62574",
"lastModified": "2026-07-23T18:29:34.653",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "secalert_us@oracle.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-62574",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T13:09:05.278980Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-07-21T22:19:09.667",
"references": [
{
"source": "secalert_us@oracle.com",
"url": "https://www.oracle.com/security-alerts/cpujul2026.html"
}
],
"sourceIdentifier": "secalert_us@oracle.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-284"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
GHSA-5CP5-8443-8V7R
Vulnerability from github – Published: 2026-07-22 00:32 – Updated: 2026-07-22 00:32
VLAI
Details
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2026-62574"
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-21T22:19:09Z",
"severity": "HIGH"
},
"details": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
"id": "GHSA-5cp5-8443-8v7r",
"modified": "2026-07-22T00:32:34Z",
"published": "2026-07-22T00:32:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62574"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2026.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
NCSC-2026-0261
Vulnerability from csaf_ncscnl - Published: 2026-07-22 15:24 - Updated: 2026-07-22 15:24Summary
Kwetsbaarheden verholpen in Oracle Java SE
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Oracle heeft meerdere kwetsbaarheden verholpen in Java SE (inclusief Oracle GraalVM en JavaFX componenten).
Interpretaties: Oracle Java SE en gerelateerde producten (Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition) bevatten diverse kwetsbaarheden die een niet-geauthenticeerde aanvaller met netwerktoegang via TLS of andere API's in staat stellen om gedeeltelijke denial of service te veroorzaken, kritieke data te wijzigen, of ongeautoriseerde lees- en schrijfacties uit te voeren. Deze kwetsbaarheden treffen meerdere ondersteunde versies en componenten, waaronder JSSE, JavaFX, 2D component APIs, scripting componenten en sandboxed Java Web Start applicaties of applets. Sommige kwetsbaarheden vereisen gebruikersinteractie en/of lage privileges, terwijl andere ook zonder aanwezigheid van onbetrouwbare Java Web Start applicaties kunnen worden misbruikt. De impact varieert van denial of service tot ongeautoriseerde datawijziging en systeemcompromittering. Verschillende CVSS-scores zijn toegekend, variërend van laag (3.1) tot hoger (7.8), afhankelijk van de specifieke kwetsbaarheid en exploitatiemogelijkheden.
Oplossingen: Oracle heeft updates uitgebracht om de kwetsbaarheden in Java SE (inclusief Oracle GraalVM en JavaFX componenten) te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-190: Integer Overflow or Wraparound
CWE-265: Privilege Issues
CWE-295: Improper Certificate Validation
CWE-347: Improper Verification of Cryptographic Signature
CWE-400: Uncontrolled Resource Consumption
CWE-476: NULL Pointer Dereference
CWE-696: Incorrect Behavior Order
CWE-787: Out-of-bounds Write
CWE-1333: Inefficient Regular Expression Complexity
Little CMS versions up to 2.18 contain integer overflow vulnerabilities in the CubeSize and ParseCube functions, as well as improper handling of malformed ICC profiles, leading to potential information disclosure, denial of service, or arbitrary code execution.
7.5 (High)
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / GraalVM
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM Enterprise Edition
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM for JDK
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Java SE
|
vers:unknown/* |
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers via TLS to cause a partial denial of service through specific APIs without requiring untrusted Java Web Start applications or applets.
5.3 (Medium)
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / GraalVM
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM Enterprise Edition
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM for JDK
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Java SE
|
vers:unknown/* |
A vulnerability in Oracle Java SE's JSSE component allows unauthenticated attackers with network access via TLS to potentially modify critical data, affecting multiple versions with a CVSS score of 5.9.
5.9 (Medium)
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / GraalVM
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM Enterprise Edition
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM for JDK
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Java SE
|
vers:unknown/* |
A vulnerability in Oracle Java SE and Oracle GraalVM allows unauthenticated network attackers to potentially perform unauthorized data modifications via APIs, affecting multiple supported versions with a CVSS score of 3.7.
CWE-787 - Out-of-bounds WriteAffected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / GraalVM
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM Enterprise Edition
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM for JDK
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Java SE
|
vers:unknown/* |
A vulnerability in Oracle Java SE 8u491's JavaFX component allows unauthenticated network attackers to cause partial denial of service by exploiting APIs, mainly impacting sandboxed Java Web Start applications or applets with a CVSS 3.1 score of 5.3.
5.3 (Medium)
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / GraalVM
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM Enterprise Edition
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM for JDK
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Java SE
|
vers:unknown/* |
A vulnerability in Oracle Java SE and Oracle GraalVM 2D component APIs allows unauthenticated network attackers to cause a partial denial of service, with a CVSS score of 5.3.
5.3 (Medium)
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / GraalVM
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM Enterprise Edition
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM for JDK
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Java SE
|
vers:unknown/* |
A vulnerability in multiple supported versions of Oracle Java SE libraries allows unauthenticated network attackers to cause a partial denial of service via APIs, including those used in sandboxed Java Web Start applications or applets, with a CVSS score of 5.3.
5.3 (Medium)
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / GraalVM
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM Enterprise Edition
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM for JDK
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Java SE
|
vers:unknown/* |
A vulnerability in Oracle Java SE 8u491's JavaFX component allows an unauthenticated network attacker, requiring user interaction, to potentially modify accessible data in sandboxed Java applications, with a CVSS 3.1 base score of 3.1.
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / GraalVM
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM Enterprise Edition
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM for JDK
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Java SE
|
vers:unknown/* |
A vulnerability in Oracle Java SE 8u491's JavaFX component allows an unauthenticated network attacker, requiring user interaction, to potentially modify accessible data in sandboxed Java applications, with a CVSS 3.1 base score of 3.1.
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / GraalVM
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM Enterprise Edition
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM for JDK
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Java SE
|
vers:unknown/* |
A vulnerability in Oracle Java SE 8u491's JavaFX component allows an unauthenticated network attacker, requiring user interaction, to potentially modify accessible data in sandboxed Java applications, with a CVSS 3.1 base score of 3.1.
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / GraalVM
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM Enterprise Edition
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM for JDK
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Java SE
|
vers:unknown/* |
A vulnerability in Oracle Java SE scripting component versions 8u491, 8u491-perf, and 11.0.31 allows unauthenticated attackers to cause denial of service via network access without affecting confidentiality or integrity.
7.5 (High)
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / GraalVM
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM Enterprise Edition
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM for JDK
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Java SE
|
vers:unknown/* |
A vulnerability in Oracle Java SE Scripting component versions 8u491, 8u491-perf, and 11.0.31 allows unauthenticated network attackers to gain unauthorized access or modify critical data via APIs, with a CVSS 3.1 base score of 7.4.
7.4 (High)
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / GraalVM
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM Enterprise Edition
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM for JDK
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Java SE
|
vers:unknown/* |
A vulnerability in Oracle Java SE and Oracle GraalVM allows unauthenticated network attackers to cause a partial denial of service, mainly impacting sandboxed Java applications running untrusted code, with a CVSS score of 3.7.
CWE-476 - NULL Pointer DereferenceAffected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / GraalVM
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM Enterprise Edition
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM for JDK
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Java SE
|
vers:unknown/* |
A critical vulnerability in Oracle Java SE and Oracle GraalVM allows unauthenticated network attackers to modify or delete critical data via exploitable APIs, with a CVSS integrity impact score of 7.5.
7.5 (High)
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / GraalVM
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM Enterprise Edition
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM for JDK
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Java SE
|
vers:unknown/* |
A vulnerability in Oracle Java SE and Oracle GraalVM allows unauthenticated network attackers to gain unauthorized read and write access to certain data via exploitable APIs, affecting multiple supported versions with a CVSS score of 6.5.
6.5 (Medium)
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / GraalVM
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM Enterprise Edition
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM for JDK
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Java SE
|
vers:unknown/* |
A vulnerability in Oracle Java SE 8u491's JavaFX component allows an unauthenticated network attacker, requiring user interaction, to potentially gain unauthorized read access to data in sandboxed Java Web Start applications or applets, with a CVSS 3.1 score of 3.1.
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / GraalVM
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM Enterprise Edition
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM for JDK
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Java SE
|
vers:unknown/* |
A vulnerability in Oracle Java SE 8u491's JavaFX component allows an unauthenticated network attacker, requiring user interaction, to potentially gain unauthorized read access to data in sandboxed Java Web Start applications or applets, with a CVSS 3.1 score of 3.1.
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / GraalVM
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM Enterprise Edition
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM for JDK
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Java SE
|
vers:unknown/* |
A vulnerability in Oracle Java SE 8u491 and 8u491-perf allows a low-privileged attacker with infrastructure access and user interaction to compromise confidentiality, integrity, and availability, with a CVSS score of 6.7.
6.7 (Medium)
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / GraalVM
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM Enterprise Edition
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM for JDK
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Java SE
|
vers:unknown/* |
A high-severity vulnerability in multiple versions of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows low-privileged attackers with logon access to potentially compromise affected systems.
7.8 (High)
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / GraalVM
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM Enterprise Edition
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM for JDK
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Java SE
|
vers:unknown/* |
References
21 references
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Oracle heeft meerdere kwetsbaarheden verholpen in Java SE (inclusief Oracle GraalVM en JavaFX componenten).",
"title": "Feiten"
},
{
"category": "description",
"text": "Oracle Java SE en gerelateerde producten (Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition) bevatten diverse kwetsbaarheden die een niet-geauthenticeerde aanvaller met netwerktoegang via TLS of andere API\u0027s in staat stellen om gedeeltelijke denial of service te veroorzaken, kritieke data te wijzigen, of ongeautoriseerde lees- en schrijfacties uit te voeren. Deze kwetsbaarheden treffen meerdere ondersteunde versies en componenten, waaronder JSSE, JavaFX, 2D component APIs, scripting componenten en sandboxed Java Web Start applicaties of applets. Sommige kwetsbaarheden vereisen gebruikersinteractie en/of lage privileges, terwijl andere ook zonder aanwezigheid van onbetrouwbare Java Web Start applicaties kunnen worden misbruikt. De impact varieert van denial of service tot ongeautoriseerde datawijziging en systeemcompromittering. Verschillende CVSS-scores zijn toegekend, vari\u00ebrend van laag (3.1) tot hoger (7.8), afhankelijk van de specifieke kwetsbaarheid en exploitatiemogelijkheden.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Oracle heeft updates uitgebracht om de kwetsbaarheden in Java SE (inclusief Oracle GraalVM en JavaFX componenten) te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Integer Overflow or Wraparound",
"title": "CWE-190"
},
{
"category": "general",
"text": "Privilege Issues",
"title": "CWE-265"
},
{
"category": "general",
"text": "Improper Certificate Validation",
"title": "CWE-295"
},
{
"category": "general",
"text": "Improper Verification of Cryptographic Signature",
"title": "CWE-347"
},
{
"category": "general",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
},
{
"category": "general",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
},
{
"category": "general",
"text": "Incorrect Behavior Order",
"title": "CWE-696"
},
{
"category": "general",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "general",
"text": "Inefficient Regular Expression Complexity",
"title": "CWE-1333"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://www.oracle.com/security-alerts/cpujul2026.html"
},
{
"category": "external",
"summary": "Reference",
"url": "https://www.oracle.com/security-alerts/cpujul2026verbose.html"
}
],
"title": "Kwetsbaarheden verholpen in Oracle Java SE",
"tracking": {
"current_release_date": "2026-07-22T15:24:20.106317Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0261",
"initial_release_date": "2026-07-22T15:24:20.106317Z",
"revision_history": [
{
"date": "2026-07-22T15:24:20.106317Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "GraalVM"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "Oracle GraalVM Enterprise Edition"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-3"
}
}
],
"category": "product_name",
"name": "Oracle GraalVM for JDK"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-4"
}
}
],
"category": "product_name",
"name": "Oracle Java SE"
}
],
"category": "vendor",
"name": "Oracle"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-41254",
"cwe": {
"id": "CWE-696",
"name": "Incorrect Behavior Order"
},
"notes": [
{
"category": "other",
"text": "Incorrect Behavior Order",
"title": "CWE-696"
},
{
"category": "other",
"text": "Integer Overflow or Wraparound",
"title": "CWE-190"
},
{
"category": "description",
"text": "Little CMS versions up to 2.18 contain integer overflow vulnerabilities in the CubeSize and ParseCube functions, as well as improper handling of malformed ICC profiles, leading to potential information disclosure, denial of service, or arbitrary code execution.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-41254 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41254.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2026-41254"
},
{
"cve": "CVE-2026-46917",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers via TLS to cause a partial denial of service through specific APIs without requiring untrusted Java Web Start applications or applets.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-46917 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-46917.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2026-46917"
},
{
"cve": "CVE-2026-46968",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"notes": [
{
"category": "other",
"text": "Improper Certificate Validation",
"title": "CWE-295"
},
{
"category": "description",
"text": "A vulnerability in Oracle Java SE\u0027s JSSE component allows unauthenticated attackers with network access via TLS to potentially modify critical data, affecting multiple versions with a CVSS score of 5.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-46968 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-46968.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2026-46968"
},
{
"cve": "CVE-2026-47010",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "A vulnerability in Oracle Java SE and Oracle GraalVM allows unauthenticated network attackers to potentially perform unauthorized data modifications via APIs, affecting multiple supported versions with a CVSS score of 3.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-47010 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-47010.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2026-47010"
},
{
"cve": "CVE-2026-47013",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE 8u491\u0027s JavaFX component allows unauthenticated network attackers to cause partial denial of service by exploiting APIs, mainly impacting sandboxed Java Web Start applications or applets with a CVSS 3.1 score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-47013 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-47013.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2026-47013"
},
{
"cve": "CVE-2026-47021",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"notes": [
{
"category": "other",
"text": "Inefficient Regular Expression Complexity",
"title": "CWE-1333"
},
{
"category": "description",
"text": "A vulnerability in Oracle Java SE and Oracle GraalVM 2D component APIs allows unauthenticated network attackers to cause a partial denial of service, with a CVSS score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-47021 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-47021.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2026-47021"
},
{
"cve": "CVE-2026-47027",
"notes": [
{
"category": "description",
"text": "A vulnerability in multiple supported versions of Oracle Java SE libraries allows unauthenticated network attackers to cause a partial denial of service via APIs, including those used in sandboxed Java Web Start applications or applets, with a CVSS score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-47027 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-47027.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2026-47027"
},
{
"cve": "CVE-2026-47030",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE 8u491\u0027s JavaFX component allows an unauthenticated network attacker, requiring user interaction, to potentially modify accessible data in sandboxed Java applications, with a CVSS 3.1 base score of 3.1.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-47030 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-47030.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2026-47030"
},
{
"cve": "CVE-2026-47034",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE 8u491\u0027s JavaFX component allows an unauthenticated network attacker, requiring user interaction, to potentially modify accessible data in sandboxed Java applications, with a CVSS 3.1 base score of 3.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-47034 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-47034.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2026-47034"
},
{
"cve": "CVE-2026-47035",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE 8u491\u0027s JavaFX component allows an unauthenticated network attacker, requiring user interaction, to potentially modify accessible data in sandboxed Java applications, with a CVSS 3.1 base score of 3.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-47035 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-47035.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2026-47035"
},
{
"cve": "CVE-2026-47057",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "other",
"text": "Integer Overflow or Wraparound",
"title": "CWE-190"
},
{
"category": "description",
"text": "A vulnerability in Oracle Java SE scripting component versions 8u491, 8u491-perf, and 11.0.31 allows unauthenticated attackers to cause denial of service via network access without affecting confidentiality or integrity.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-47057 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-47057.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2026-47057"
},
{
"cve": "CVE-2026-47058",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "A vulnerability in Oracle Java SE Scripting component versions 8u491, 8u491-perf, and 11.0.31 allows unauthenticated network attackers to gain unauthorized access or modify critical data via APIs, with a CVSS 3.1 base score of 7.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-47058 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-47058.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2026-47058"
},
{
"cve": "CVE-2026-47059",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "other",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
},
{
"category": "description",
"text": "A vulnerability in Oracle Java SE and Oracle GraalVM allows unauthenticated network attackers to cause a partial denial of service, mainly impacting sandboxed Java applications running untrusted code, with a CVSS score of 3.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-47059 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-47059.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2026-47059"
},
{
"cve": "CVE-2026-47063",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"notes": [
{
"category": "other",
"text": "Improper Verification of Cryptographic Signature",
"title": "CWE-347"
},
{
"category": "description",
"text": "A critical vulnerability in Oracle Java SE and Oracle GraalVM allows unauthenticated network attackers to modify or delete critical data via exploitable APIs, with a CVSS integrity impact score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-47063 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-47063.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2026-47063"
},
{
"cve": "CVE-2026-60147",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"notes": [
{
"category": "other",
"text": "Improper Certificate Validation",
"title": "CWE-295"
},
{
"category": "description",
"text": "A vulnerability in Oracle Java SE and Oracle GraalVM allows unauthenticated network attackers to gain unauthorized read and write access to certain data via exploitable APIs, affecting multiple supported versions with a CVSS score of 6.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60147 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60147.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2026-60147"
},
{
"cve": "CVE-2026-60164",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE 8u491\u0027s JavaFX component allows an unauthenticated network attacker, requiring user interaction, to potentially gain unauthorized read access to data in sandboxed Java Web Start applications or applets, with a CVSS 3.1 score of 3.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60164 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60164.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2026-60164"
},
{
"cve": "CVE-2026-60166",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE 8u491\u0027s JavaFX component allows an unauthenticated network attacker, requiring user interaction, to potentially gain unauthorized read access to data in sandboxed Java Web Start applications or applets, with a CVSS 3.1 score of 3.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60166 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60166.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2026-60166"
},
{
"cve": "CVE-2026-60526",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE 8u491 and 8u491-perf allows a low-privileged attacker with infrastructure access and user interaction to compromise confidentiality, integrity, and availability, with a CVSS score of 6.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60526 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60526.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2026-60526"
},
{
"cve": "CVE-2026-62574",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in multiple versions of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows low-privileged attackers with logon access to potentially compromise affected systems.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62574 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62574.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2026-62574"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…