CVE-2026-60166

Analyzed Analyzed - Analysis Complete

JavaFX Unauthorized Data Read Vulnerability in Oracle Java SE

Publication date: 2026-07-21

Last updated on: 2026-08-03

Assigner: Oracle

Description

Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-03

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60166

EUVD

EUVD-2026-46572

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	jre	1.8.0
oracle	jdk	1.8.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Java SE, specifically in the JavaFX component. It affects version 8u491 and allows an unauthenticated attacker to potentially read some data from the system through network access. The attack requires the victim to interact with a malicious application or applet, and it only works in client-side deployments that run untrusted code.

Detection Guidance

Detection involves checking for vulnerable Oracle Java SE versions. Use commands like 'java -version' to verify installed versions. Ensure JavaFX is not running untrusted code from the internet.

Impact Analysis

If you run Java applications or applets from untrusted sources, an attacker could exploit this to read some of your data. This is only possible if you interact with a malicious application or applet, such as one downloaded from the internet.

Compliance Impact

This vulnerability could potentially lead to unauthorized data access, which may impact compliance with regulations like GDPR or HIPAA if sensitive data is exposed. Organizations using affected Java versions should assess their risk and apply patches to mitigate exposure.

Mitigation Strategies

Upgrade Oracle Java SE to a version beyond 8u491. Disable Java Web Start applications and sandboxed Java applets if not required. Restrict network access to trusted sources only.

Hi! I’m here to help you understand CVE-2026-60166. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70