CVE-2026-60147

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, and 26.0.1 Oracle GraalVM for JDK versions 17.0.19 and 21.0.11 Oracle GraalVM Enterprise Edition version 21.3.18

Description A security flaw in the Security component allows an unauthenticated attacker with network access via multiple protocols to compromise the system. This can be achieved by using APIs in the affected component, such as through a web service that provides data to those APIs. The issue also impacts Java deployments that run untrusted code in a sandbox, such as Java Web Start applications or Java applets. Successful exploitation may lead to unauthorized read access to a subset of data, as well as unauthorized update, insert, or delete access to certain accessible data.

Recommendations Update Oracle Java SE to versions 8u491, 11.0.32, 17.0.20, 21.0.12, 25.0.4, or 26.0.2. Update Oracle GraalVM for JDK to versions 17.0.20 or 21.0.12. Update Oracle GraalVM Enterprise Edition to a version newer than 21.3.18.