CVE-2026-60147 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition should apply security updates to prevent potential exploitation of this vulnerability. This includes organizations that use these products for development, testing, or production environments. Additionally, security teams and vulnerability management teams should review their deployments and ensure that affected versions are updated to prevent potential unauthorized access. Operators and platform administrators should also review their systems and apply security updates as needed. Vulnerability management teams should prioritize this vulnerability based on its CVSS score and potential impact on their organization. Security teams should monitor for suspicious activity and implement compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory teams should ensure that all affected systems are identified and prioritized for remediation. IT teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Compliance teams should verify that remediation efforts meet regulatory requirements. Incident response teams should be prepared to respond to potential exploitation of this vulnerability. Business stakeholders should be informed of the potential risks and remediation efforts. Auditors should verify that remediation efforts are properly documented and meet organizational policies and procedures. Change management teams should ensure that all changes are properly reviewed, tested, and implemented. Problem management teams should identify and mitigate potential problems related to this vulnerability. Release management teams should ensure that all releases are properly tested and validated before deployment. Configuration management teams should ensure that all configurations are properly set and validated. IT service continuity teams should ensure that all IT services are properly maintained and validated. IT service desk teams should be prepared to handle potential issues related to this vulnerability. Security awareness and training teams should provide training on this.

Technical summary

The CVE-2026-60147 vulnerability is a security issue in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. It allows an unauthenticated attacker with network access via multiple protocols to compromise these products, potentially leading to unauthorized update, insert or delete access to some accessible data as well as unauthorized read access to a subset of accessible data. The vulnerability has a CVSS 3.1 Base Score of 6.5 and is classified as MEDIUM severity. The vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security.

Defensive priority

Apply security updates for Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition to prevent potential unauthorized access.

Recommended defensive actions

• Apply security updates for Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition
• Restrict network access to affected products
• Monitor for suspicious activity
• Implement compensating controls
• Inventory and update affected systems

Evidence notes

The CVE-2026-60147 vulnerability affects multiple versions of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. Supported versions that are affected include Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. The vulnerability allows an unauthenticated attacker with network access via multiple protocols to compromise these products, potentially leading to unauthorized update, insert or delete access to some accessible data as well as unauthorized read access to a subset of accessible data.

Official resources