NCSC-2026-0314 [1.00] [M/H] Vulnerabilities resolved in Oracle Java SE

unknownCVE-2026-60589 CVE-2026-61308 CVE-2026-62574 CVE-2026-70906 CVE-2026-70907

Oracle has resolved vulnerabilities in Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition. The vulnerabilities affect multiple supported versions of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition. An unauthorized attacker with network access can via various attack vectors obtain unauthorized access to certain or all available data, with some vulnerabilities leading to complete compromise of the system including privilege escalation and execution of unauthorized actions. Additionally, there are vulnerabilities that cause denial of service by making systems crash or hang, including via sandboxed Java Web Start applications and applets. Some vulnerabilities can be exploited via HTTP or TLS without authentication. The impact ranges from unauthorized data disclosure to disruption of the availability of Java runtime environments.

CSIRTS triage

vendor: Oracle product: Java SE Remote code execution Authentication bypass Privilege escalation Information disclosure Denial of serviceaffected: multiple supported versions

What: Multiple vulnerabilities in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition allow remote attackers to obtain unauthorized access, escalate privileges, execute code, or cause denial of service.
Who is affected: Deployments running affected versions of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition.
Urgency: High; vulnerabilities can be exploited via HTTP or TLS without authentication, leading to complete system compromise or denial of service.
Action: Apply security updates from Oracle for all affected Java SE and GraalVM versions immediately.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Java SE

Get an email when a new Java SE advisory drops — max one per day, one-click unsubscribe.

Details

Source: NCSC-NL Advisories (NL · national-cert · site)
Severity: unknown
Published: 2026-08-19
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0314

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-605890.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-613080.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-625740.11% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-709060.44% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 37% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-709070.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-60589	coverage & exploitation status	NVD · CVE.org
CVE-2026-61308	coverage & exploitation status	NVD · CVE.org
CVE-2026-62574	coverage & exploitation status	NVD · CVE.org
CVE-2026-70906	coverage & exploitation status	NVD · CVE.org
CVE-2026-70907	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.