Oracle Java SE CVE-2026-60526

Exploitation requires the attacker to hold a low-privileged local account (PR:L) on the system where Oracle Java SE 8u491 or 8u491-perf executes - remote unauthenticated access is not possible per AV:L. High attack complexity (AC:H) means specific timing or environmental conditions must align, characteristic of race conditions or requiring a narrow exploitation window. Human interaction from a person other than the attacker is required (UI:R), most plausibly a privileged user performing or triggering a Java installation or update action concurrently. The vulnerability is also triggerable via APIs in the Installation component reached through sandboxed Java Web Start applications or sandboxed Java applets loading untrusted code - this path requires the target system to have Java Web Start active and a user to load an untrusted JNLP or applet. Limiting factors: local-only attack vector excludes all remote exploitation scenarios; AC:H reduces exploit reliability significantly; UI:R introduces a social engineering or scheduling dependency; only Java SE 8u491 and 8u491-perf are confirmed affected.

The CVSS 3.1 base score of 6.7 is moderate but the impact sub-scores are maximal (C:H/I:H/A:H), reflecting a gap between exploitability and potential damage. Four separate prerequisites constrain real-world exploitation: local system access (AV:L), low-privileged credentials (PR:L), high attack complexity (AC:H - specific timing or environmental conditions required), and third-party human interaction (UI:R). This combination makes opportunistic, automated exploitation implausible. No EPSS score, KEV listing, or POC is available in the provided intelligence, preventing quantitative likelihood assessment. The sandboxed Java Web Start and applet vector is a noteworthy expansion of attack surface for client-side deployments, though Java Web Start has been deprecated since JDK 11 and its use in Java 8 environments signals legacy infrastructure. Real-world prioritization should weight the local-only access requirement heavily - this is not a remotely exploitable vulnerability against server infrastructure. Environments running Java 8u491 in client workstation roles with Web Start enabled represent the higher-risk population.

A low-privileged local attacker on a workstation running Oracle Java SE 8u491 plants a malicious file or symlink in a path accessible during the installation component's file resolution sequence, then waits for a privileged user to trigger an install, update, or Web Start launch operation. During that interaction (UI:R), the high-complexity race condition or path traversal resolves in the attacker's favor, resulting in the attacker's payload being executed or a privileged file being overwritten - achieving full control over the Java SE runtime environment. No public proof-of-concept code has been identified at time of analysis.