What is the CVSS score of CVE-2026-60526?

CVE-2026-60526 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Oracle Java SE CVE-2026-60526

EUVD-2026-46888 MEDIUM

Improper Input Validation (CWE-20)

2026-07-21 secalert_us@oracle.com

GHSA-8658-gj58-hrr8

Oracle Java Information Disclosure Jdk Jre

6.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.7 MEDIUM

AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

6.7 MEDIUM

Vendor vector is consistent with installation-component attack: local-only access, low privilege, high complexity race condition, and required privileged-user interaction, with no scope change.

3.1 AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:10 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

MEDIUM 6.7

DescriptionCVE.org

Vulnerability in Oracle Java SE (component: Installation). Supported versions that are affected are Oracle Java SE: 8u491 and 8u491-perf. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Java SE 8u491 and 8u491-perf is achievable by a low-privileged local attacker exploiting a flaw in the Installation component, disclosed as part of Oracle's July 2026 Critical Patch Update. The attack chain requires high complexity - indicating race conditions or precise timing - combined with human interaction from a third party, likely a privileged user performing installation or update activity. No public exploit code has been identified and CISA KEV listing is absent at time of analysis, but the C:H/I:H/A:H impact triad makes successful exploitation fully destructive to the affected Java SE instance.

Technical ContextAI

The vulnerability resides in the Installation component of Oracle Java SE, limited to the Java 8 LTS branch at patch levels 8u491 and 8u491-perf. Installation components in Java SE typically handle privileged file operations, directory creation, registry writes (Windows), and symlink resolution during setup and update sequences. The local attack vector (AV:L) and high complexity (AC:H) are consistent with race conditions (TOCTOU) or untrusted search path manipulation during privileged installation operations - common CWE classes for this component type, though no formal CWE is assigned. The vendor description explicitly notes the vulnerability is also reachable via APIs from sandboxed Java Web Start applications or sandboxed Java applets loading untrusted code from the internet, broadening the attack surface to client-side Java deployments that rely on sandbox isolation. Tags indicate Information Disclosure is a component of the impact alongside the full-takeover potential reflected in the CVSS impact metrics.

RemediationAI

The primary remediation is to apply Oracle's July 2026 Critical Patch Update patches for Java SE, referenced at https://www.oracle.com/security-alerts/cpujul2026.html. An exact fixed version number beyond the CPU cycle is not independently confirmed in the available intelligence - consult the Oracle advisory directly to identify the patched release for Java 8. As compensating controls where immediate patching is not feasible: restrict local logon rights on Java SE hosts to operationally necessary accounts, reducing exposure from the PR:L prerequisite. Disable Java Web Start (jnlp file association and the javaws executable) if not in active use, eliminating the API-call attack vector noted in the description - this carries no functional impact in environments not using Web Start. Avoid running Java 8u491 installation or update processes in sessions accessible to lower-privileged concurrent users. Monitor file system activity in Java installation directories (e.g., %PROGRAMFILES%\Java or /usr/lib/jvm) for anomalous writes or symlink creation during installation windows.