Oracle Java SE CVE-2026-60164

Exploitation is restricted to client-side Java deployments where Java Web Start applications or Java applets load and execute untrusted code from the internet, with the Java security sandbox serving as the primary security boundary - server-side deployments running only trusted code are explicitly excluded. Active user interaction is required: the victim must visit an attacker-controlled site and launch or engage with the malicious JavaFX content (UI:R). High attack complexity (AC:H) indicates that exploitation requires specific, non-trivial conditions to be met beyond simple delivery. Modern browsers do not support Java applets natively, so exploitation requires a legacy browser plugin or a user who manually launches a JNLP file via Java Web Start. No attacker authentication is required. Limiting factors include: AC:H complexity threshold, mandatory victim interaction, Java 8 extended-support-only affected release, and near-obsolescence of the Java applet and Web Start deployment model in modern enterprise environments.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N yields a Low score of 3.1, and the signal constellation consistently supports low real-world priority. High attack complexity (AC:H) means exploitation is not straightforward and requires specific conditions to align. Mandatory user interaction (UI:R) eliminates unaided remote exploitation. The scope is unchanged (S:U) with impact limited to partial confidentiality loss - no integrity or availability impact whatsoever. No EPSS data was provided in the available intelligence. No CISA KEV listing exists and no publicly known exploit code has been identified, consistent with the low CVSS. The 'Authentication Bypass' tag warrants clarification: the CVSS PR:N reflects that the attacker does not require authentication credentials, but the tag likely refers to Java sandbox security control bypass rather than credential bypass - these are distinct concepts and should not be conflated. The most significant real-world limiting factor is deployment prevalence: Java Web Start was deprecated in Java SE 9 (2017) and removed in Java SE 11, and modern browsers dropped Java plugin support years ago. Environments still running Java SE 8 with sandboxed applet or JWS functionality represent a shrinking and typically unmanaged legacy estate. For such environments, this is a genuine - if low-severity - sandbox escape requiring prioritized patching.

An attacker crafts a malicious Java Web Start application or Java applet hosted on an attacker-controlled web server, embedding JavaFX content designed to trigger the sandbox bypass. The attacker social-engineers a victim running Oracle Java SE 8u491 into navigating to the site and launching or interacting with the malicious Java content - for example via a phishing email linking to a JNLP file. Upon interaction, the JavaFX vulnerability is triggered, allowing the attacker's sandboxed code to read a subset of data accessible within the Java SE runtime context. No public exploit code has been identified at time of analysis.