CVE-2026-60147 in GraalVM Enterprise Edition
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within the security component of Oracle Java SE and its associated GraalVM implementations, representing a critical concern for enterprise environments that rely on these platforms. The affected versions span multiple release lines including Java SE 8, 11, 17, 21, and 25, alongside specific GraalVM versions for both standard and enterprise editions. The vulnerability's classification as easily exploitable indicates that attackers can compromise systems without requiring authentication or specialized access privileges, making it particularly dangerous in networked environments where Java applications are exposed to external threats.
The technical flaw manifests through multiple protocols that enable unauthorized access to sensitive data within the Java runtime environment. Attackers can exploit this vulnerability to perform unauthorized modifications to data including updates, inserts, and deletions, while simultaneously gaining read access to restricted information subsets. The exploitation pathway leverages APIs within the affected component, making web services particularly vulnerable when they interface with these APIs and process external data inputs. This vulnerability's impact extends beyond traditional server deployments to include client-side Java applications that utilize sandboxed environments such as Java Web Start applications or applets, where untrusted code execution can occur.
The operational consequences of this vulnerability are significant for organizations deploying Oracle Java SE or GraalVM solutions across their infrastructure. The CVSS 3.1 base score of 6.5 reflects moderate to high severity with impacts to both confidentiality and integrity, indicating that attackers can access sensitive data while potentially modifying critical information within the affected systems. Organizations running sandboxed applications in client environments face particular risk as these deployments typically rely on Java's security model for protection against malicious code execution. The vulnerability's applicability to multiple deployment scenarios including server-side applications, web services, and client-side sandboxes creates a broad attack surface that requires comprehensive mitigation strategies.
Security professionals should implement immediate remediation measures including applying the latest Oracle patches and updates to all affected versions of Java SE and GraalVM implementations. Network segmentation and access controls should be strengthened to limit exposure of vulnerable systems to untrusted networks. Application-level protections should include input validation, API rate limiting, and monitoring for suspicious activities that may indicate exploitation attempts. Organizations should also consider implementing additional security controls such as application whitelisting, sandboxing restrictions, and regular vulnerability assessments to detect potential exploitation attempts. The vulnerability's alignment with CWE categories related to insecure data handling and access control violations underscores the importance of comprehensive security measures beyond simple patch management.
The attack surface for this vulnerability extends to environments where Java applications process external inputs through web services or other API interfaces, making it particularly concerning for organizations with extensive web application deployments. The fact that this vulnerability affects both standard Java SE implementations and specialized GraalVM environments indicates a fundamental issue within the security framework of these platforms. Organizations should conduct thorough risk assessments to identify all systems running affected versions and implement layered security approaches that provide defense in depth against potential exploitation attempts. This includes monitoring network traffic for anomalous patterns, implementing intrusion detection systems, and maintaining detailed audit logs to facilitate forensic analysis if exploitation occurs.
The vulnerability's classification under ATT&CK framework categories related to privilege escalation and data manipulation highlights the multi-faceted nature of the threat it presents. Security teams must develop incident response procedures specifically addressing potential exploitation scenarios involving unauthorized data access and modification. Regular security training for development teams should emphasize secure coding practices when working with Java APIs and web services, particularly regarding input validation and proper error handling. The vulnerability's impact on both server-side and client-side applications demonstrates the need for comprehensive security policies that address all deployment scenarios within an organization's Java ecosystem. Continuous monitoring and threat intelligence integration will be essential for early detection of potential exploitation attempts targeting these specific vulnerable configurations.