What is the CVSS score of EUVD-2026-47562?

EUVD-2026-47562 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Oracle Java SE are affected by EUVD-2026-47562?

Local privilege escalation in Oracle Java SE and GraalVM (versions 8u491-26.0.1) allows any low-privileged user with system access to completely compromise the Java runtime, achieving full…

How to fix or mitigate EUVD-2026-47562?

Within 24 hours, inventory all systems running affected Oracle Java SE versions (8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1) and Oracle GraalVM editions (17.0.19, 21.0.11, 21.3.18), and identify the total count of low-privileged user accounts with local system logon access. Within 7 days, enforce principle-of-least-privilege access controls to minimize local logon accounts, implement enhanced logging and alerting on Java process privilege escalation attempts, restrict interactive system access for low-privileged users, and disable unnecessary local system access on non-development machines. Within 30 days, establish a patching readiness plan aligned with Oracle's release schedule, prepare isolated test environments to validate Java updates, and deploy interim mitigations including Java Security Manager policy restrictions and application-level process isolation where feasible, pending vendor patch availability.

Oracle Java SE EUVD-2026-47562

| CVE-2026-62574 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-5cp5-8443-8v7r

Authentication Bypass Java Oracle Graalvm Graalvm For Jdk Jdk Jre

7.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local Install-component flaw needing a low-privileged logon (AV:L/PR:L), no user interaction, yielding full host takeover so C:H/I:H/A:H with unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:30 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 7.8

DescriptionCVE.org

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Articles & Coverage 1

News 6 New Java Vulnerabilities - 1 Critical, 5 High Severity Jul 22, 2026

AnalysisAI

Local privilege escalation to full takeover in the Install component of Oracle Java SE (8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1), Oracle GraalVM for JDK (17.0.19, 21.0.11), and Oracle GraalVM Enterprise Edition (21.3.18) lets a low-privileged local user compromise the runtime and take it over with full confidentiality, integrity, and availability loss. Oracle rates it 7.8 (High) and describes it as easily exploitable by an attacker holding only a logon to the host. No public exploit has been identified at time of analysis and it is not on CISA KEV.

Technical ContextAI

The flaw resides in the Install component - the platform installer/updater tooling that deploys the Oracle Java SE and GraalVM runtimes, typically the Windows installer path. Vulnerabilities in this component historically stem from untrusted search-path or insecure privilege handling (e.g. CWE-426 Untrusted Search Path / CWE-427 Uncontrolled Search Path Element), where an installer or helper executes a file or library from a location writable by a low-privileged user while running in an elevated context. The CWE is not populated in the source data (N/A), so the exact root-cause class is inferred from the Install component plus the local, low-privilege, high-impact CVSS profile rather than confirmed. Affected products span the mainstream LTS and non-LTS JDK lines (8, 11, 17, 21, 25, 26) plus the GraalVM distributions built on 17 and 21.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory - upgrade each affected JDK/GraalVM to the corresponding fixed build in its release line. Oracle does not publish exact per-CVE fixed version strings, so obtain the precise target build from the July 2026 CPU matrix rather than assuming a number. Because exploitation requires local logon, effective compensating controls until patching are to restrict interactive/local logon rights on hosts running these runtimes, tighten filesystem ACLs on installer and JDK directories so non-administrative users cannot write to search-path locations (trade-off: may break user-scoped installs), and remove or de-elevate any auto-update/installer helpers running with elevated privileges on shared systems.

More in Java

View all

CVE-2012-4681 CRITICAL Emergency POC

9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m

CVE-2015-7450 CRITICAL Emergency POC

9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti

CVE-2013-2465 CRITICAL Act Now POC

9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent

CVE-2011-3544 CRITICAL Act Now POC

9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug

CVE-2010-1871 HIGH Act Now POC

8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to

CVE-2012-1723 CRITICAL Emergency POC

9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up

CVE-2013-0422 CRITICAL Emergency POC

9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using

CVE-2012-0507 CRITICAL Emergency POC

9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up

CVE-2015-4852 CRITICAL Act Now POC

9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL Act Now POC

9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow

CVE-2017-3066 CRITICAL Act Now POC

9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla

CVE-2012-0391 CRITICAL Act Now POC

9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-284 – Improper Access Control

View all

CVE-2012-4681 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2012-1723 CRITICAL POC

9.8

CVE-2012-5076 CRITICAL POC

9.8

CVE-2014-3120 HIGH POC

8.1

CVE-2013-2423 LOW POC

3.7

CVE-2016-3427 CRITICAL

9.8

CVE-2025-12480 CRITICAL POC

9.1

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

CVE-2023-46805 HIGH POC

8.2

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected

EUVD-2026-47562 vulnerability details – vuln.today

Back

Oracle Java SE EUVD-2026-47562

Severity by source

CVSS VectorVendor: oracle

Lifecycle Timeline

DescriptionCVE.org

Articles & Coverage 1

AnalysisAI

Technical ContextAI

RemediationAI

More in Java

Same weakness CWE-284 – Improper Access Control

Same technique Authentication Bypass

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code