This vulnerability (CVE-2026-60589) affects Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition in their security components. It is difficult to exploit and requires network access with high attack complexity and no privileges or user interaction. Successful exploitation results in unauthorized read access to a subset of accessible data. The vulnerability can be triggered by supplying data to certain APIs without involving untrusted Java Web Start applications or applets. The CVSS 3.1 base score is 3.7, indicating a low impact on confidentiality and no impact on integrity or availability. Affected versions include Oracle Java SE 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK 17.0.20 and 21.0.12; and Oracle GraalVM Enterprise Edition 21.3.19.

The impact of this vulnerability is limited to unauthorized read access to some accessible data within the affected Oracle Java SE and GraalVM products. There is no impact on data integrity or availability. The vulnerability is rated low severity with a CVSS score of 3.7. There are no known exploits in the wild.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that includes fixes for this and many other vulnerabilities. Customers are strongly advised to apply the available security patches promptly and remain on actively supported versions. The vendor advisory does not indicate that no action is required or that the issue is already mitigated. Therefore, applying the official Oracle patches is the recommended mitigation.