Oracle Java SE CVE-2026-62574

Exploitation requires the attacker to already possess a local logon (a valid low-privileged account) on the machine where Oracle Java SE or GraalVM is installed, and the vulnerable Install component (installer/updater tooling) must be present or invoked on that host - this is a local-only vector (AV:L), so no remote or network path exists. Limiting factors: the attacker must have interactive/local access (PR:L, not PR:N), the flaw is confined to the Install component rather than the general JRE at runtime, and impact is bounded to the local host (S:U, no scope change). No victim user interaction is required (UI:N), and it cannot be reached by a purely remote, unauthenticated attacker.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) is internally consistent and describes a local, low-complexity, low-privilege escalation with full CIA impact - a host-level takeover once an attacker already has a foothold, not a remotely reachable bug. No EPSS score, SSVC decision, POC, or KEV signal is present in the provided data, so exploitation-probability evidence is absent; Oracle's 'easily exploitable' phrasing is qualitative, not a quantitative signal. A conflict worth flagging: the intelligence tags list 'Information Disclosure,' yet the CVSS records C:H/I:H/A:H and Oracle explicitly states 'takeover' - the tag understates the true integrity/availability impact and should be disregarded in favor of the vector. Real-world priority is moderate-to-high on multi-user or shared hosts and workstations where untrusted local users exist, but lower on single-tenant servers where an attacker with local logon likely already holds elevated access.

An attacker who already holds an ordinary low-privileged local account on a workstation or shared host places a malicious file in a location the Install component reads, then triggers or waits for the installer/updater to execute it in an elevated context, achieving full takeover of the Java/GraalVM runtime and host-level compromise. No victim user interaction and no network access are required. No public POC has been identified at time of analysis.