CVE-2026-60589: Infoleak

Published Aug 10, 2026
·
Updated

Last updated 21 September 2026

Other sources

URIDereferencer does not properly use the base URI from XMLCryptoContext when downloading data.

— Red Hat

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

— NVD

Affected Software

9 affected componentsFixes available
Oracle Java SE>=8u501<=8u501, >=11.0.32<=11.0.32, >=17.0.20<=17.0.20, >=21.0.12<=21.0.12, >=25.0.4<=25.0.4, >=26.0.2<=26.0.2
Oracle GraalVM for JDK>=17.0.20<=17.0.20, >=21.0.12<=21.0.12
Oracle GraalVM Enterprise Edition>=21.3.19<=21.3.19
debian/openjdk-11
11.0.33~4ea-1
debian/openjdk-17<=17.0.19+10-1~deb12u2
17.0.20.1+1-1~deb12u117.0.21~6ea-1
debian/openjdk-21
21.0.12.1+1-1~deb13u121.0.12.1+1-121.0.13~6ea-1
debian/openjdk-25<=25.0.3+9-2~deb13u1
25.0.4.1+1-1~deb13u125.0.4.1+1-125.0.5~6ea-1
debian/openjdk-26
26.0.2.1+1-1
debian/openjdk-8
8u504-ga-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/openjdk-11 to a version that resolves this vulnerability.

    Fixed in 11.0.33~4ea-1
  2. Upgrade

    Upgrade debian/openjdk-17 to a version that resolves this vulnerability.

    Fixed in 17.0.20.1+1-1~deb12u1Fixed in 17.0.21~6ea-1
  3. Upgrade

    Upgrade debian/openjdk-21 to a version that resolves this vulnerability.

    Fixed in 21.0.12.1+1-1~deb13u1Fixed in 21.0.12.1+1-1Fixed in 21.0.13~6ea-1
  4. Upgrade

    Upgrade debian/openjdk-25 to a version that resolves this vulnerability.

    Fixed in 25.0.4.1+1-1~deb13u1Fixed in 25.0.4.1+1-1Fixed in 25.0.5~6ea-1
  5. Upgrade

    Upgrade debian/openjdk-26 to a version that resolves this vulnerability.

    Fixed in 26.0.2.1+1-1
  6. Upgrade

    Upgrade debian/openjdk-8 to a version that resolves this vulnerability.

    Fixed in 8u504-ga-1
  7. Upgrade

    Upgrade Oracle Java SE to a version that resolves this vulnerability.

    Fixed in 8u501
  8. Upgrade

    Upgrade Oracle Java SE to a version that resolves this vulnerability.

    Fixed in 11.0.32
  9. Upgrade

    Upgrade Oracle Java SE to a version that resolves this vulnerability.

    Fixed in 17.0.20
  10. Upgrade

    Upgrade Oracle Java SE to a version that resolves this vulnerability.

    Fixed in 21.0.12
  11. Upgrade

    Upgrade Oracle Java SE to a version that resolves this vulnerability.

    Fixed in 25.0.4
  12. Upgrade

    Upgrade Oracle Java SE to a version that resolves this vulnerability.

    Fixed in 26.0.2
  13. Upgrade

    Upgrade Oracle GraalVM for JDK to a version that resolves this vulnerability.

    Fixed in 17.0.20
  14. Upgrade

    Upgrade Oracle GraalVM for JDK to a version that resolves this vulnerability.

    Fixed in 21.0.12
  15. Upgrade

    Upgrade Oracle GraalVM Enterprise Edition to a version that resolves this vulnerability.

    Fixed in 21.3.19
  16. Configuration

    Do not use Untrusted Java Web Start applications or Untrusted Java applets to supply data to the specified Component; the note states exploitation is only possible when data is supplied to APIs in the component without using untrusted Java Web Start applications or untrusted Java applets (e.g., via a web service).

    Untrusted Java Web Start applications / Untrusted Java applets usage = disallow
  17. Compensating control

    Limit exposure of the affected APIs/services (that supply data to the specified Component) to reduce network-accessible attack surface, since the vulnerability is described as difficult to exploit but reachable from network via multiple protocols.

Event History

Aug 10, 2026
Data Sourced
via Red Hat·07:53 AM
DescriptionSeverityAffected Software
Aug 18, 2026
CVE Published
via MITRE·08:58 PM
Data Sourced
via MITRE·08:58 PM
DescriptionSeverity
Data Sourced
via NVD·09:16 PM
DescriptionSeverityWeakness
Sep 22, 2026
Data Sourced
via Ubuntu·12:55 AM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·12:56 AM
Description
Data Sourced
via Debian·12:56 AM
DescriptionAffected Software

Frequently Asked Questions

1

Which deployments are exposed to this issue?

Affected deployments are Oracle Java SE 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, and 26.0.2; Oracle GraalVM for JDK 17.0.20 and 21.0.12; and Oracle GraalVM Enterprise Edition 21.3.19. Exploitation requires that an attacker can supply data to APIs in the Security component, such as through a web service.

2

Does exploitation require credentials, user interaction, or Java Web Start or applet content?

No credentials or user interaction are required, and the attacker needs network access through multiple protocols. The issue is not exploitable through untrusted Java Web Start applications or untrusted Java applets; it requires supplying data directly to the relevant APIs.

3

What is the expected impact if exploitation succeeds?

A successful attack can provide unauthorized read access to a subset of data accessible to the affected Java SE or GraalVM product. The provided CVSS vector indicates a low confidentiality impact, with no integrity or availability impact.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203