CVE-2026-60166 is a low-severity vulnerability in Oracle Java SE 8u491's JavaFX component. It allows an unauthenticated attacker with network access via multiple protocols to compromise the product by gaining unauthorized read access to a subset of accessible data. Successful exploitation requires user interaction from a third party. The vulnerability affects client-side Java deployments that run untrusted code in sandboxed environments, such as Java Web Start applications or applets, and does not impact server-side deployments running only trusted code. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and low confidentiality impact. Oracle's July 2026 Critical Patch Update advisory does not explicitly mention a patch for this vulnerability, and no patch links are provided. Customers are advised to stay on supported versions and apply security patches promptly.

The vulnerability allows unauthorized read access to some data accessible by Oracle Java SE 8u491 in client-side sandboxed environments. It does not affect integrity or availability, and exploitation requires user interaction from a person other than the attacker. The impact is limited to confidentiality with a low CVSS score of 3.1. Server-side Java deployments running only trusted code are not affected.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends remaining on actively supported versions and applying security patches without delay. Since no specific patch or workaround is currently documented for this vulnerability, users should monitor Oracle advisories for updates. No contradictory vendor guidance indicating no action required is present.