CVE-2026-60589: 
Amazon Corretto JDK vulnerability analysis and mitigation

CVE-2026-60589 is a low-severity information disclosure vulnerability in the Security component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. The flaw affects Oracle Java SE versions 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, and 26.0.2; Oracle GraalVM for JDK versions 17.0.20 and 21.0.12; and Oracle GraalVM Enterprise Edition version 21.3.19. It was publicly disclosed on August 18, 2026, as part of Oracle's August 2026 Critical Security Patch Update (CSPU). The vulnerability carries a CVSS v3.1 base score of 3.7 (Low) (Oracle CSPU Aug 2026, Red Hat Bugzilla).

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and stems from improper resource resolving in the Java Security component. Specifically, the URIDereferencer does not properly use the base URI from XMLCryptoContext when downloading data, which can lead to unauthorized read access to a subset of accessible data (Red Hat Bugzilla). Exploitation requires an unauthenticated attacker with network access to supply data to the affected APIs — such as through a web service — without relying on Untrusted Java Web Start applications or Untrusted Java applets. The attack complexity is rated High, meaning exploitation is not straightforward and requires specific conditions to be met (Oracle CSPU Aug 2026).

Successful exploitation allows an unauthenticated remote attacker to read a subset of data accessible to the affected Oracle Java SE or GraalVM instance, resulting in a limited confidentiality impact. There is no impact on integrity or availability. The scope is limited to data accessible through the vulnerable Security component APIs exposed over the network, and there is no evidence of lateral movement potential or broader system compromise associated with this vulnerability (Oracle CSPU Aug 2026, Red Hat Bugzilla).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed (Feedly). The EPSS score is approximately 0.0026 (0.26%), reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as not automatable, further reducing its practical risk (Oracle CSPU Aug 2026).

Oracle has released patches as part of the August 2026 Critical Security Patch Update; users should upgrade to the next available patched release beyond the affected versions (8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2 for Java SE; 17.0.20 and 21.0.12 for GraalVM for JDK; 21.3.19 for GraalVM Enterprise Edition) (Oracle CSPU Aug 2026). Red Hat has issued multiple errata (e.g., RHSA-2026:55775, RHSA-2026:55778, RHSA-2026:55779, RHSA-2026:55780, RHSA-2026:57118) addressing this CVE across RHEL 8, RHEL 9, and OpenJDK ELS builds (Red Hat Bugzilla). IBM has also released patches for affected IBM SDK Java Technology Edition and Enterprise Content Management System Monitor products (IBM Advisory). As a temporary workaround, Oracle recommends limiting network exposure of Java-based web services and APIs to trusted sources only until patching is complete (Oracle CSPU Aug 2026).

The vulnerability received routine coverage as part of Oracle's August 2026 CSPU, which addressed 943 security patches across Oracle product families. Downstream vendors including Red Hat, IBM, Amazon (Corretto/Amazon Linux), AlmaLinux, openSUSE, and Azul promptly issued their own advisories and patches. No notable independent researcher commentary or significant social media discussion specific to CVE-2026-60589 has been identified, consistent with its low severity rating (Oracle CSPU Aug 2026, IBM Advisory).