CVE-2026-60166 in Java SE
Summary
by MITRE • 07/22/2026
Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/24/2026
This vulnerability resides within Oracle Java SE version 8u491, specifically affecting the JavaFX component which represents a significant security concern for client-side Java deployments. The flaw manifests as a difficulty to exploit condition that requires an unauthenticated attacker with network access through multiple protocols to compromise the system. The vulnerability's classification as having high attack complexity (AC:H) indicates that exploitation requires specific conditions or circumstances beyond simple network access, though it remains achievable within the context of typical client-side Java execution environments.
The technical nature of this vulnerability stems from the Java sandbox security model that protects against malicious code execution in client applications. When Java Web Start applications or applets load untrusted code from internet sources, they rely on sandbox restrictions to prevent unauthorized operations. However, this particular flaw allows for unauthorized read access to a subset of data within Oracle Java SE, representing a confidentiality impact as indicated by the CVSS 3.1 Base Score of 3.1. The vulnerability's impact is specifically limited to data reading operations rather than modification or complete system compromise, though the scope remains significant given that sandboxed applications typically handle sensitive user data and system information.
The operational impact of this vulnerability extends particularly to environments where users interact with untrusted Java content through web browsers or Java Web Start applications. These deployments represent common attack vectors in enterprise and consumer environments where users frequently encounter Java applets embedded in websites or download applications via Java Web Start technology. The requirement for human interaction (UI:R) suggests that successful exploitation typically requires user engagement such as clicking on a malicious link or downloading an infected application, making this vulnerability particularly concerning in social engineering scenarios where attackers can manipulate users into executing malicious code within the Java sandbox environment.
The attack surface is primarily limited to client-side deployments running in sandboxed environments, specifically excluding server-side Java installations that typically run only trusted code. This distinction aligns with common security practices where servers employ stricter access controls and code validation than client applications. The vulnerability's applicability to Java deployments that load untrusted code from the internet makes it particularly relevant for organizations using legacy Java technologies in web-based applications or older systems that haven't been migrated away from Java applet usage. Organizations maintaining such environments face heightened risk of data leakage through this vulnerability, as attackers can potentially extract sensitive information from within the sandboxed Java runtime environment.
Security mitigations should focus on immediate patching of affected Oracle Java SE 8u491 installations to address the JavaFX component vulnerability. Additionally, organizations should consider implementing network segmentation and access controls to limit exposure of Java-based client applications to untrusted internet sources. Browser security configurations should be reviewed to disable or restrict Java applet execution in web browsers where possible, as this represents a primary attack vector for exploitation. The vulnerability's classification under CWE categories related to sandbox bypasses and information disclosure highlights the need for comprehensive application security reviews focusing on client-side code execution environments. Organizations should also consider implementing network monitoring solutions to detect unusual data access patterns that might indicate exploitation attempts, particularly in environments where Java applets or Web Start applications are still actively used.