CVE-2026-60526: 
Amazon Corretto JDK vulnerability analysis and mitigation

CVE-2026-60526 is an improper input validation vulnerability in the Installation component of Oracle Java SE, affecting versions 8u491 and 8u491-perf (including the Enterprise Performance Pack variant). Disclosed on July 21, 2026, as part of Oracle's Critical Patch Update for July 2026, the vulnerability allows a low-privileged local attacker — with required human interaction from another user — to fully compromise the Oracle Java SE runtime. It carries a CVSS v3.1 base score of 6.7 (Medium) (Oracle CPU Jul 2026, Feedly).

The vulnerability is classified under CWE-20 (Improper Input Validation) and resides in the Installation component of Oracle Java SE. The attack vector is local (AV:L), requires high attack complexity (AC:H), low privileges (PR:L), and user interaction (UI:R), with no change in scope. Exploitation can occur through APIs in the Installation component — for example, via a web service supplying data to those APIs — and also applies to Java deployments running sandboxed Java Web Start applications or applets that load untrusted code from the internet. No public proof-of-concept or detailed technical write-up has been identified at this time (Oracle CPU Jul 2026, Feedly).

Successful exploitation results in a full takeover of Oracle Java SE, with high impact to confidentiality, integrity, and availability of the Java runtime environment. An attacker who successfully exploits this vulnerability could execute arbitrary code with the privileges of the Java process, potentially accessing sensitive data, modifying application behavior, or causing denial of service. The vulnerability is particularly relevant in environments running sandboxed Java Web Start applications or applets that process untrusted internet-sourced code (Oracle CPU Jul 2026, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability is rated as non-automatable by NVD SSVC analysis, and the EPSS score is approximately 0.118%, indicating a low probability of near-term exploitation. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys scanner (detection ID 387986) has been updated to detect this vulnerability (Feedly, Oracle CPU Jul 2026).

Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update. Affected users should update Oracle Java SE from versions 8u491 or 8u491-perf to a patched release as soon as possible. As interim mitigations, Oracle recommends restricting local logon access to systems running affected Java versions, limiting user privileges, and disabling Java Web Start or applet functionality if not required. Oracle strongly advises against relying on workarounds as a long-term solution (Oracle CPU Jul 2026).