Jre: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). (CVE-2026-62574)
A high-severity vulnerability (CVE-2026-62574) affects multiple versions of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition in the Install component. The vulnerability allows a low-privileged attacker with access to the infrastructure to potentially take over the affected products. The CVSS 3.1 base score is 7.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released patches addressing this vulnerability in their July and August 2026 Critical Patch Updates. Users are strongly advised to apply these patches promptly to mitigate risk.
AI Analysis
Technical Summary
CVE-2026-62574 is a vulnerability in the Install component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. It affects specific versions including Oracle Java SE 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, and 26.0.2; Oracle GraalVM for JDK versions 17.0.20 and 21.0.12; and Oracle GraalVM Enterprise Edition 21.3.19. The flaw allows a low-privileged attacker with logon access to the infrastructure to compromise the affected products, potentially resulting in full takeover. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local attack vector with low complexity and no user interaction required, and high impact on confidentiality, integrity, and availability. Oracle has included fixes for this vulnerability in their July and August 2026 Critical Patch Updates, which contain numerous security patches across many Oracle products.
Potential Impact
Successful exploitation of this vulnerability can lead to complete compromise of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition installations. This includes full control over the affected software, impacting confidentiality, integrity, and availability. The vulnerability requires the attacker to have low-privileged access to the infrastructure where the software runs, but no user interaction is needed. There are no known exploits in the wild at this time.
Mitigation Recommendations
Oracle has released official patches for this vulnerability as part of their July and August 2026 Critical Patch Updates. Users should apply these patches without delay to mitigate the risk. Oracle strongly recommends remaining on actively supported versions and promptly applying security updates. No additional mitigations or workarounds are specified by Oracle beyond patching.
Jre: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). (CVE-2026-62574)
Description
A high-severity vulnerability (CVE-2026-62574) affects multiple versions of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition in the Install component. The vulnerability allows a low-privileged attacker with access to the infrastructure to potentially take over the affected products. The CVSS 3.1 base score is 7.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released patches addressing this vulnerability in their July and August 2026 Critical Patch Updates. Users are strongly advised to apply these patches promptly to mitigate risk.
Affected software
pkg:bitnami/javaRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-62574 is a vulnerability in the Install component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. It affects specific versions including Oracle Java SE 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, and 26.0.2; Oracle GraalVM for JDK versions 17.0.20 and 21.0.12; and Oracle GraalVM Enterprise Edition 21.3.19. The flaw allows a low-privileged attacker with logon access to the infrastructure to compromise the affected products, potentially resulting in full takeover. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local attack vector with low complexity and no user interaction required, and high impact on confidentiality, integrity, and availability. Oracle has included fixes for this vulnerability in their July and August 2026 Critical Patch Updates, which contain numerous security patches across many Oracle products.
Potential Impact
Successful exploitation of this vulnerability can lead to complete compromise of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition installations. This includes full control over the affected software, impacting confidentiality, integrity, and availability. The vulnerability requires the attacker to have low-privileged access to the infrastructure where the software runs, but no user interaction is needed. There are no known exploits in the wild at this time.
Mitigation Recommendations
Oracle has released official patches for this vulnerability as part of their July and August 2026 Critical Patch Updates. Users should apply these patches without delay to mitigate the risk. Oracle strongly recommends remaining on actively supported versions and promptly applying security updates. No additional mitigations or workarounds are specified by Oracle beyond patching.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-java-2026-62574
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-62574"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- High
- Cvss Version
- null
Threat ID: 6a85b4abacd9273b49250f54
Added to database: 08/19/2026, 13:50:35 UTC
Last enriched: 08/19/2026, 14:08:26 UTC
Last updated: 08/19/2026, 14:08:26 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.