What is the CVSS score of CVE-2026-60164?

CVE-2026-60164 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Oracle Java SE CVE-2026-60164

EUVD-2026-46570 LOW

Protection Mechanism Failure (CWE-693)

2026-07-21 oracle

GHSA-6vj8-6725-cqvx

Authentication Bypass Java Oracle Oracle Java Se Oracle Corporation

3.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

Network delivery requires victim interaction with malicious JavaFX content; high complexity; limited confidentiality read only with no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:26 vuln.today

DescriptionCVE.org

Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthorized data read in the JavaFX component of Oracle Java SE 8u491 allows a remote unauthenticated attacker to access a subset of Oracle Java SE data by luring a victim into interacting with a malicious sandboxed Java Web Start application or Java applet. The attack is constrained exclusively to client-side Java deployments that run untrusted code within the Java sandbox, with high exploitation complexity (AC:H) and mandatory user interaction (UI:R) further limiting real-world reach. No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS 3.1 score of 3.1 (Low) accurately reflects the narrow, confidentiality-only impact.

Technical ContextAI

The vulnerability resides in JavaFX, Oracle's graphical UI and media framework bundled with legacy Java SE 8 distributions. The attack surface is narrowly confined to sandboxed Java execution environments - specifically Java Web Start (JWS) applications and browser-embedded Java applets that load and execute untrusted code downloaded from the internet, relying on the Java security sandbox as their primary isolation boundary. Server-side Java deployments executing only administrator-installed trusted code are explicitly out of scope per Oracle's advisory. The CWE classification is not assigned in available data, but the 'Authentication Bypass' tag in combination with the sandbox-scoped description strongly suggests a security control bypass within the JavaFX component that allows sandboxed, untrusted code to read data it should be denied access to. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_java_se:*:*:*:*:*:*:*:*, specific to version 8u491.

RemediationAI

Apply the patch released as part of the Oracle Critical Patch Update July 2026, available via the advisory at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched version number is not independently specified in available intelligence beyond the advisory reference - consult Oracle's CPU directly to confirm the target upgrade version for Java SE 8. As a compensating control, organizations should disable Java Web Start and Java applet support entirely in any client runtime configurations, as these legacy technologies constitute the exclusive attack surface for this vulnerability; disabling them has no functional impact on modern Java applications and server workloads. Organizations running Java SE exclusively in server configurations with trusted code require no action. Given Java 8u491 is a legacy extended-support release, evaluating migration to a supported Java SE LTS release (Java 21 or Java 25) is strongly advisable for reducing ongoing exposure.