CVE-2026-60589: 
OpenJDK JDK vulnerability analysis and mitigation

CVE-2026-60589 is a vulnerability in the Security component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition, internally described as an "Improve Resource Resolving" issue related to improper URI dereferencing. Affected versions include Oracle Java SE 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, and 26.0.2; Oracle GraalVM for JDK 17.0.20 and 21.0.12; and Oracle GraalVM Enterprise Edition 21.3.19. The vulnerability was published on August 18, 2026, as part of Oracle's August 2026 Critical Security Patch Update (CSPU). It carries a CVSS v3.1 base score of 3.7 (Low) (Oracle CSPU Aug 2026, Red Hat Bugzilla).

The root cause of CVE-2026-60589 is that the URIDereferencer in the Java Security component does not properly use the base URI from XMLCryptoContext when downloading or resolving external resources, leading to unintended data access (CWE classification not formally assigned, but consistent with improper resource resolution). An unauthenticated, remote attacker can exploit this by supplying crafted data to APIs in the Security component — for example, via a web service — without relying on Untrusted Java Web Start applications or applets. Exploitation requires high attack complexity, meaning specific conditions must be met, such as a race condition or precise timing of requests (Red Hat Bugzilla, Oracle CSPU Aug 2026).

Successful exploitation results in unauthorized read access to a subset of data accessible to the affected Oracle Java SE or GraalVM instance, with no impact on integrity or availability. The confidentiality impact is limited in scope, as only a partial subset of accessible data can be exposed. This vulnerability is most relevant in server-side deployments where Java-based web services accept and process external XML or URI-based input through the Security component (Oracle CSPU Aug 2026).

There is no public proof-of-concept exploit available, and no evidence of active in-the-wild exploitation has been observed as of the time of disclosure. The EPSS score is 0.0, reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is rated as "Difficult" due to the high attack complexity requirement (Oracle CSPU Aug 2026).

Oracle has released patches for this vulnerability as part of the August 2026 Critical Security Patch Update (CSPU), published August 18–19, 2026. Affected users should apply the relevant Java SE or GraalVM patches immediately. As a temporary workaround prior to patching, Oracle recommends limiting network exposure of Java-based web services and APIs to trusted sources only, and blocking network protocols required by an attack where feasible. Oracle strongly advises against relying on workarounds as a long-term solution (Oracle CSPU Aug 2026, Red Hat Bugzilla).

Red Hat has tracked this vulnerability via its Bugzilla system (Bug 2513035) and assigned it medium priority and severity. The vulnerability was detected by Qualys scanners (detection ID 388370) and covered by AusCERT in bulletin ASB-2026.0189. No notable researcher commentary or significant social media discussion has been identified beyond standard patch advisory coverage (Red Hat Bugzilla).