Multiple vulnerabilities in Oracle Java SE (August 19, 2026)

unknownCVE-2026-62574 CVE-2026-70907 CVE-2026-61308 CVE-2026-60589 CVE-2026-70906

Multiple vulnerabilities have been discovered in Oracle Java SE. Some of them allow an attacker to cause remote arbitrary code execution, remote denial of service and data confidentiality breach.

CSIRTS triage

vendor: Oracle product: Java SE Remote code execution Denial of service Information disclosure

What: Multiple vulnerabilities in Java SE allow remote arbitrary code execution, denial of service, and data confidentiality breaches.
Who is affected: All users and systems running Oracle Java SE are potentially affected.
Urgency: Critical due to remote code execution capability affecting widely deployed Java runtime.
Action: Update to the latest patched Java SE version immediately across all systems.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Java SE

Get an email when a new Java SE advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-FR Avis de sécurité (FR · national-cert · site)
Severity: unknown
Published: 2026-08-19
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1048/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-625740.11% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-709070.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-613080.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-605890.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-709060.44% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 37% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-62574	coverage & exploitation status	NVD · CVE.org
CVE-2026-70907	coverage & exploitation status	NVD · CVE.org
CVE-2026-61308	coverage & exploitation status	NVD · CVE.org
CVE-2026-60589	coverage & exploitation status	NVD · CVE.org
CVE-2026-70906	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for Oracle Java SE

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownNCSC-2026-0314 [1.00] [M/H] Vulnerabilities resolved in Oracle Java SEncsc-nl · 2026-08-19
medium[NEW] [medium] Oracle Java SE: Multiple vulnerabilitiescert-bund · 2026-08-19
mediumCVE-2026-70907: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition…nvd · 2026-08-18
highCVE-2026-70906: Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Orac…nvd · 2026-08-18
mediumCVE-2026-61308: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition…nvd · 2026-08-18
lowCVE-2026-60589: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition…nvd · 2026-08-18