CVE-2026-60526

{
  "id": "CVE-2026-60526",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-21T22:17:52.290",
  "lastModified": "2026-10-24T18:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in Oracle Java SE (component: Installation).  Supported versions that are affected are Oracle Java SE: 8u491 and  8u491-perf. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en Oracle Java SE (componente: Instalación). Las versiones compatibles que están afectadas son Oracle Java SE: 8u491 y 8u491-perf. La vulnerabilidad difícil de explotar permite a un atacante con pocos privilegios y con inicio de sesión en la infraestructura donde se ejecuta Oracle Java SE comprometer Oracle Java SE. Los ataques exitosos requieren interacción humana de una persona que no sea el atacante. Los ataques exitosos de esta vulnerabilidad pueden resultar en la toma de control de Oracle Java SE. Nota: Esta vulnerabilidad puede ser explotada mediante el uso de APIs en el Componente especificado, p. ej., a través de un servicio web que suministra datos a las APIs. Esta vulnerabilidad también se aplica a las implementaciones de Java, típicamente en clientes que ejecutan aplicaciones Java Web Start en sandbox o applets Java en sandbox, que cargan y ejecutan código no confiable (p. ej., código que proviene de internet) y dependen del sandbox de Java para la seguridad. Puntuación Base CVSS 3.1 6.7 (impactos en Confidencialidad, Integridad y Disponibilidad). Vector CVSS: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Oracle Corporation",
          "product": "Oracle Java SE",
          "versions": [
            {
              "version": "8u491",
              "status": "affected"
            },
            {
              "version": "8u491-perf",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 6.7,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-31T00:00:00+00:00",
          "id": "CVE-2026-60526",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update491:*:*:-:*:*:*",
              "matchCriteriaId": "26A3520C-C410-4AC7-93CF-69F5CBD23CA8"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update491:*:*:enterprise_performance_pack:*:*:*",
              "matchCriteriaId": "35F51EB5-DF63-47B3-9EFF-E52B0538747E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:jre:1.8.0:update491:*:*:-:*:*:*",
              "matchCriteriaId": "D0DE5FE4-2686-4C60-B4C6-2AC9E7A538D5"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:jre:1.8.0:update491:*:*:enterprise_performance_pack:*:*:*",
              "matchCriteriaId": "D60FEE5A-22B8-4F6C-AF4F-C8B317C2D102"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.oracle.com/security-alerts/cpujul2026.html",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}