Executive brief
A vulnerability in the installation component of Oracle Java SE could allow a low-privileged user to take full control of the Java environment. To succeed, the attacker must already have access to the system and trick another user into performing a specific action. This could lead to the theft of sensitive data or a complete disruption of applications relying on Java.
Technical details
This vulnerability exists within the Installation component of Oracle Java SE versions 8u491 and 8u491-perf. It is classified as a local attack requiring low privileges, but carries high complexity and requires user interaction (UI:R). An attacker with local logon access can exploit the vulnerability through specific APIs or by supplying malicious data to web services that interact with those APIs. The flaw also impacts sandboxed environments like Java Web Start or applets that run untrusted code. A successful exploit results in a complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) for the affected Java SE instance.
Affected products
- Oracle Java SE 8u491, 8u491-perf
Timeline
- 2026-07-21: advisory: Oracle published the vulnerability details in the July 2026 CPU.
- 2026-07-21: disclosed