Quick answers
- Is CVE-2026-60164 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-60164 being exploited in the wild.
- How severe is CVE-2026-60164?
- Low severity, with a CVSS score of 3.1, published 21 July 2026.
- Which products and versions are affected?
- Oracle Java SE (JavaFX) 8u491.
- Is there a fix for CVE-2026-60164?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-60164 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-60164?
- Check whether you run Oracle Java SE (JavaFX) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability in the JavaFX component of Oracle Java SE 8u491 allows an unauthenticated attacker with network access via multiple protocols to compromise the environment. The flaw is specifically relevant to client-side deployments, such as sandboxed Java Web Start applications or applets that run untrusted code. Successful exploitation requires user interaction (UI:R) and faces high attack complexity (AC:H). If exploited, the attacker can achieve unauthorized read access (Confidentiality: Low) to a subset of data accessible by the Java process. Server-side deployments that only run trusted code are generally not affected.
Affected products
- Oracle Java SE (JavaFX) 8u491
Timeline
- 2026-07-21: disclosed
- 2026-07-21: advisory