CVE-2026-60164: 
Amazon Corretto JDK vulnerability analysis and mitigation

CVE-2026-60164 is a protection mechanism failure vulnerability in the JavaFX component of Oracle Java SE, affecting version 8u491 (JDK and JRE). It was published on July 21, 2026, as part of Oracle's July 2026 Critical Patch Update (CPU). The vulnerability allows an unauthenticated remote attacker to gain unauthorized read access to a subset of Oracle Java SE accessible data, but requires human interaction to exploit. It carries a CVSS v3.1 base score of 3.1 (Low) (Oracle CPU July 2026).

The vulnerability is classified under CWE-693 (Protection Mechanism Failure), indicating a flaw in how the JavaFX component enforces security boundaries within the Java sandbox. Exploitation requires an attacker to deliver a malicious Java Web Start application or sandboxed Java applet to a victim, who must then interact with it — for example, by visiting a malicious website or opening a crafted file. The flaw specifically affects client-side Java deployments that load and run untrusted code from the internet and rely on the Java sandbox for security; server-side deployments running only trusted code are not affected. No public proof-of-concept or technical write-up has been identified at this time (Oracle CPU July 2026).

Successful exploitation results in unauthorized read access to a subset of data accessible to the Oracle Java SE process — a confidentiality-only impact with no effect on integrity or availability. The scope is limited to the affected client system running the malicious applet or Web Start application, with no evidence of lateral movement potential. The low CVSS score reflects the constrained nature of the data exposure and the high attack complexity required (Oracle CPU July 2026).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.00184 (~0.18%), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Oracle's own assessment notes the vulnerability is "difficult to exploit" and requires user interaction, further reducing practical exploitability (Oracle CPU July 2026).

Oracle has released a patch for this vulnerability as part of the July 2026 Critical Patch Update. Users should update Oracle Java SE 8 to a version newer than 8u491 by applying the July 2026 CPU patch. As a workaround, organizations should avoid running untrusted Java Web Start applications or sandboxed Java applets, and consider disabling Java browser plugins where not required. Oracle strongly recommends applying security patches as soon as possible rather than relying on network-level mitigations as a long-term solution (Oracle CPU July 2026).