Description
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-08-18
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability permits an unauthenticated attacker who has network connectivity to supply malicious data to specific APIs in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. The flaw provides unauthorized read access to a subset of data that the Java components expose, affecting confidentiality but not integrity or availability. The weakness is an information‑exposure flaw uncovered by insufficient protection of sensitive data.

Affected Systems

Oracle Corporation’s affected products are Oracle Java SE (versions 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2), Oracle GraalVM for JDK (versions 17.0.20 and 21.0.12), and Oracle GraalVM Enterprise Edition (21.3.19). Red Hat CPE entries for OpenJDK distributions also appear in the listing, but the primary vulnerability concerns the Oracle distributions.

Risk and Exploitability

The CVSS base score of 3.7 indicates low severity, with a confidentiality impact only; the EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network‑based: an attacker can send crafted requests over multiple protocols to the vulnerable APIs without authentication. Successful exploitation grants the attacker the ability to read information that should be protected, yet it does not allow modification or disruption of the affected systems.

Generated by OpenCVE AI on August 21, 2026 at 16:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle Java SE update that addresses CVE-2026-60589 to all affected release streams (8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2).
  • Upgrade Oracle GraalVM for JDK to the latest release that contains the fix, such as 17.0.21 or later, and update Oracle GraalVM Enterprise Edition to 21.3.20 or higher.
  • Use firewalls or network segmentation to restrict access to the vulnerable Java APIs, limiting exposure to trusted hosts only, thereby reducing the potential attack surface.

Generated by OpenCVE AI on August 21, 2026 at 16:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4756-1 openjdk-11 security update
Debian DLA Debian DLA DLA-4757-1 openjdk-17 security update
Debian DSA Debian DSA DSA-6457-1 openjdk-21 security update
Debian DSA Debian DSA DSA-6460-1 openjdk-25 security update
History

Thu, 20 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle graalvm Enterprise Edition
Vendors & Products Oracle graalvm Enterprise Edition

Thu, 20 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Read Access via API in Oracle Java SE and GraalVM OpenJDK: Improve Resource Resolving (2026-08 Security Update)
First Time appeared Redhat
Redhat enterprise Linux
Redhat enterprise Linux Eus
Redhat hummingbird
Redhat openjdk
Redhat openjdk Els
Redhat rhel E4s
Redhat rhel Els
Redhat rhel Eus
CPEs cpe:/a:redhat:enterprise_linux:8
cpe:/a:redhat:enterprise_linux:9
cpe:/a:redhat:hummingbird:1
cpe:/a:redhat:openjdk:1.8
cpe:/a:redhat:openjdk:17
cpe:/a:redhat:openjdk:21
cpe:/a:redhat:openjdk:25
cpe:/a:redhat:openjdk_els:11::el7
cpe:/a:redhat:openjdk_els:11::el8
cpe:/a:redhat:openjdk_els:11::el9
cpe:/a:redhat:rhel_e4s:9.4
cpe:/a:redhat:rhel_eus:9.6
cpe:/o:redhat:enterprise_linux:10.2
cpe:/o:redhat:enterprise_linux_eus:10.0
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat
Redhat enterprise Linux
Redhat enterprise Linux Eus
Redhat hummingbird
Redhat openjdk
Redhat openjdk Els
Redhat rhel E4s
Redhat rhel Els
Redhat rhel Eus
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 18 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Read Access via API in Oracle Java SE and GraalVM
Weaknesses CWE-200

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle graalvm
Oracle graalvm For Jdk
Oracle java Se
CPEs cpe:2.3:a:oracle:graalvm:21.3.19:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:17.0.20:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:21.0.12:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:11.0.32:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:17.0.20:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:21.0.12:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:25.0.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:26.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u501:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle graalvm
Oracle graalvm For Jdk
Oracle java Se
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Graalvm Graalvm Enterprise Edition Graalvm For Jdk Java Se
Redhat Enterprise Linux Enterprise Linux Eus Hummingbird Openjdk Openjdk Els Rhel E4s Rhel Els Rhel Eus
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-21T16:46:00.077Z

Reserved: 2026-07-08T15:51:40.546Z

Link: CVE-2026-60589

cve-icon Vulnrichment

Updated: 2026-08-20T17:20:29.717Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-18T21:16:38.247

Modified: 2026-08-20T18:16:28.807

Link: CVE-2026-60589

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-18T09:09:00Z

Links: CVE-2026-60589 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T16:15:03Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor