What is the CVSS score of CVE-2026-60166?

CVE-2026-60166 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Oracle JavaFX CVE-2026-60166

EUVD-2026-46572 LOW

Protection Mechanism Failure (CWE-693)

2026-07-21 oracle

GHSA-wwpq-2327-6x93

Authentication Bypass Java Oracle Oracle Java Se Oracle Corporation

3.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

Oracle's vendor vector is independently confirmed as accurate: network-delivered, high complexity due to sandbox circumvention prerequisites, no attacker privileges, active user interaction required, low confidentiality impact only with no integrity or availability consequence.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:25 vuln.today

DescriptionCVE.org

Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).

AnalysisAI

JavaFX in Oracle Java SE 8u491 exposes a limited confidentiality breach to unauthenticated network attackers who can induce a user into executing untrusted Java content within a sandboxed client environment. The impact is strictly read-only access to a subset of sandbox-accessible data - no integrity or availability consequences are present. No public exploit has been identified at time of analysis, CISA has not listed this in KEV, and the high attack complexity alongside mandatory user interaction makes opportunistic or automated exploitation unlikely.

Technical ContextAI

The affected component is JavaFX, the rich client GUI toolkit bundled with older Oracle Java SE distributions, specifically version 8u491 (CPE: cpe:2.3:a:oracle_corporation:oracle_java_se:*:*:*:*:*:*:*:*). JavaFX is tightly integrated into Java SE 8 and provides media, graphics, and UI rendering capabilities. The root cause class is formally unclassified (CWE: N/A per available data), though the 'Authentication Bypass' tag alongside Oracle's sandbox-scoped description is consistent with a Java security sandbox bypass pattern - a class of vulnerability where the JavaFX subsystem fails to enforce sandbox restrictions on untrusted code, allowing that code to read data it should not be permitted to access. The vulnerability is architecturally scoped to client-side Java execution models: Java Web Start (JNLP) applications and Java applets loading untrusted internet-sourced code. Server-side JVM deployments executing only administrator-provisioned trusted code are explicitly out of scope per Oracle's own disclosure language.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026 via the advisory at https://www.oracle.com/security-alerts/cpujul2026.html; the exact patched version superseding 8u491 is not independently confirmed in available source data beyond the advisory reference, so consult the CPU directly for the specific fix version. As a highly effective compensating control that eliminates applicability of this vulnerability class entirely, disable Java Web Start and Java applet execution on client systems - both technologies are deprecated and offer negligible business value in modern environments, and Oracle's own disclosure states the vulnerability does not apply when only trusted code is executed. For organizations that cannot immediately patch, restricting Java client deployments to administrator-controlled trusted code only removes the attack surface without requiring a version upgrade. If Java Web Start cannot be disabled organizationally, network-layer controls that block JNLP file delivery from untrusted internet sources reduce exposure, though with the trade-off of requiring allowlist maintenance for any legitimate JNLP-based internal applications.