CVE-2026-60164 is a vulnerability in the JavaFX component of Oracle Java SE version 8u491. It allows an unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE by gaining unauthorized read access to a subset of accessible data. Successful exploitation requires user interaction from a third party, making it difficult to exploit. The vulnerability affects client-side Java deployments that run untrusted code in sandboxed environments, such as Java Web Start applications or applets. Server-side Java deployments running only trusted code are not impacted. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and low confidentiality impact without integrity or availability impact. Oracle's July 2026 Critical Patch Update advisory does not explicitly confirm a patch for this vulnerability, but strongly recommends applying available patches for all vulnerabilities.

The vulnerability allows unauthorized read access to a subset of data accessible by Oracle Java SE 8u491 in client-side sandboxed environments. There is no impact on integrity or availability. Exploitation requires network access and user interaction from a person other than the attacker, making exploitation difficult. Server-side deployments running only trusted code are not affected.

Oracle's advisory does not explicitly confirm a patch or fix for CVE-2026-60164. Customers are strongly recommended to remain on actively supported versions of Oracle Java SE and apply Oracle Critical Patch Updates promptly to address this and other vulnerabilities. Since exploitation requires user interaction, educating users to avoid interacting with untrusted Java content can reduce risk. Monitor Oracle's security advisories for updates regarding a specific patch for this vulnerability.