CVE-2026-62574: 
Amazon Corretto JDK vulnerability analysis and mitigation

CVE-2026-62574 is an improper access control vulnerability in the Install component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. It was published on July 21, 2026, as part of Oracle's Critical Patch Update for July 2026. Affected versions include Oracle Java SE: 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, and 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; and Oracle GraalVM Enterprise Edition: 21.3.18. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Oracle CPU Jul 2026, GitHub Advisory).

The vulnerability is classified as CWE-284 (Improper Access Control), meaning the affected Install component fails to properly restrict access to resources from unauthorized actors. The attack vector is local (AV:L), requiring a low-privileged attacker with logon access to the infrastructure where the affected Java product executes — no user interaction is needed and attack complexity is low. The flaw resides specifically in the installation component of the Java SE and GraalVM products, suggesting it may involve insecure file or directory permissions, unprotected installer artifacts, or misconfigured access controls during the installation process. No public proof-of-concept or detailed technical write-up has been identified at this time (Oracle CPU Jul 2026, GitHub Advisory).

Successful exploitation allows a low-privileged local attacker to achieve full takeover of the affected Oracle Java SE, Oracle GraalVM for JDK, or Oracle GraalVM Enterprise Edition installation, resulting in high impacts to confidentiality, integrity, and availability. An attacker could read sensitive data managed by the Java runtime, modify system files and configurations, and disrupt service availability. Given the widespread deployment of Java SE across enterprise environments, exploitation could serve as a stepping stone for privilege escalation or lateral movement on affected hosts (Oracle CPU Jul 2026, GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time, as confirmed by NVD SSVC assessment (exploitation: none) and Feedly's executive summary. The EPSS score is approximately 0.11% (2nd percentile), indicating a low near-term probability of exploitation. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Oracle CPU Jul 2026, GitHub Advisory).

Oracle has addressed this vulnerability through the July 2026 Critical Patch Update. Users should apply the patches provided for their respective product versions (Oracle Java SE: 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19, 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18). As an interim measure, Oracle recommends restricting local logon access to systems running these products to trusted users only, and monitoring for suspicious local activity or unauthorized privilege escalation attempts. Oracle strongly advises against relying on workarounds as a long-term solution and urges immediate patch application (Oracle CPU Jul 2026, GitHub Advisory).