NCSC-2026-0261 [1.00] [M/H] Vulnerabilities fixed in Oracle Java SE
Oracle has fixed multiple vulnerabilities in Java SE (including Oracle GraalVM and JavaFX components). Oracle Java SE and related products (Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition) contain various vulnerabilities that allow an unauthenticated attacker with network access via TLS or other APIs to cause partial denial of service, modify critical data, or perform unauthorized read and write actions. These vulnerabilities affect multiple supported versions and components, including JSSE, JavaFX, 2D component APIs, scripting components, and sandboxed Java Web Start applications or applets. Some vulnerabilities require user interaction and/or low privileges, while others can be exploited without the presence of untrusted Java Web Start applications. The impact ranges from denial of service to unauthorized data modification and system compromise. Various CVSS scores have been assigned, ranging from low (3.1) to higher (7.8), depending on the specific vulnerability and exploitability.
CSIRTS triage
- What
- The vulnerabilities allow unauthorized read and write actions and can cause partial denial of service.
- Who is affected
- Users of Oracle Java SE and related products.
- Urgency
- Remediation is necessary as some vulnerabilities can be exploited without user interaction.
- Action
- Update to the latest version of Oracle Java SE.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Java SE
Get an email when a new Java SE advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0261
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-412540.36% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all scored CVEs.
- Low exploitation riskCVE-2026-469170.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all scored CVEs.
- Low exploitation riskCVE-2026-469680.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all scored CVEs.
- Low exploitation riskCVE-2026-470100.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 16% of all scored CVEs.
- Low exploitation riskCVE-2026-470130.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all scored CVEs.
- Low exploitation riskCVE-2026-470210.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all scored CVEs.
- Low exploitation riskCVE-2026-470270.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all scored CVEs.
- Low exploitation riskCVE-2026-470300.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 11% of all scored CVEs.
- Low exploitation riskCVE-2026-470340.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 11% of all scored CVEs.
- Low exploitation riskCVE-2026-470350.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all scored CVEs.
Referenced CVEs
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- medium[NEW] [medium] Oracle Java SE: Multiple vulnerabilitiescert-bund
- unknownMultiple vulnerabilities in Oracle Java SE (July 23, 2026)cert-fr-avis
- highCVE-2026-62574: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition…nvd
- mediumCVE-2026-60526: Vulnerability in Oracle Java SE (component: Installation). Supported versions that are affecte…nvd
- lowCVE-2026-60166: Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is…nvd
- lowCVE-2026-60164: Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is…nvd
- mediumCVE-2026-60147: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition…nvd
- highCVE-2026-47063: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition…nvd
- lowCVE-2026-47059: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition…nvd
- highCVE-2026-47058: Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected a…nvd
- highCVE-2026-47057: Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected a…nvd
- lowCVE-2026-47035: Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is…nvd
More from NCSC-NL Advisories
- unknownNCSC-2026-0274 [1.00] [M/H] Kwetsbaarheid verholpen in SolarWinds Web Help Desk2026-07-31
- unknownNCSC-2026-0273 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Campaign Classic2026-07-31
- unknownNCSC-2026-0272 [1.00] [M/H] Kwetsbaarheden verholpen in JFrog Artifactory2026-07-31
- unknownNCSC-2026-0271 [1.00] [M/H] Vulnerability fixed in Cisco Secure Firewall Management Center2026-07-30
- unknownNCSC-2026-0270 [1.00] [M/M] Vulnerabilities fixed in GitLab by GitLab Inc.2026-07-30