CVE-2026-62574

highpriority · track · 0EPSS 0.001 · 1 %ileDEEUNLUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.11% (1st) EPSS

CVSS 7.8 · high

Is it mine?

100 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · osv · cert_bund

EPSS · scored 2026-10-27

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

cvss

Technical severity, 0–10. One row per scoring source.

7.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · secalert_us@oracle.com USexploitability 1.8 · impact 5.9

v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-284US

affected products (100)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Azul Zuluall versionscert_bundDEcpe:/a:azul:zulu:-
Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
HCL BigFix Complianceall versionscert_bundDEcpe:/a:hcltech:bigfix:compliance
IBM App Connect Enterpriseall versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:-
IBM App Connect Enterprise 12.0.1.0-12.0.12.28all versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:12.0.1.0_-_12.0.12.28
IBM App Connect Enterprise 13.0.1.0-13.0.8.1all versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:13.0.1.0_-_13.0.8.1
IBM Business Automation Workflowall versionscert_bundDEcpe:/a:ibm:business_automation_workflow:-
IBM DB2all versionscert_bundDEcpe:/a:ibm:db2:-
IBM InfoSphere Information Server 11.7.0.0-11.7.1.6all versionscert_bundDEcpe:/a:ibm:infosphere_information_server:11.7.0.0_-_11.7.1.6
IBM Integration Bus for z/OS 10.1.0.0-10.1.0.7all versionscert_bundDEcpe:/a:ibm:integration_bus:for_zos_10.1.0.0_-_10.1.0.7
IBM Javaall versionscert_bundDEcpe:/a:ibm:jre:-
IBM Rational Business Developerall versionscert_bundDEcpe:/a:ibm:rational_business_developer:-
IBM Rational ClearQuestall versionscert_bundDEcpe:/a:ibm:rational_clearquest:-
IBM SPSSall versionscert_bundDEcpe:/a:ibm:spss:modeler
IBM Security Verify Accessall versionscert_bundDEcpe:/a:ibm:security_verify_access:-
IBM Semeru Runtime 11.0.12.0-11.0.30.0all versionscert_bundDEcpe:/a:ibm:semeru_runtime:11.0.12.0_-_11.0.30.0
IBM Semeru Runtime 17.0.0.0-17.0.19.0all versionscert_bundDEcpe:/a:ibm:semeru_runtime:17.0.0.0_-_17.0.19.0
IBM Semeru Runtime 21.0.0.0-21.0.10.0all versionscert_bundDEcpe:/a:ibm:semeru_runtime:21.0.0.0_-_21.0.10.0
IBM Semeru Runtime 25.0.0.0-25.0.2.0all versionscert_bundDEcpe:/a:ibm:semeru_runtime:25.0.0.0_-_25.0.2.0

showing 20 of 100

advisories (7)

Vendor and ecosystem advisories describing this.

NCSC-2026-0261Kwetsbaarheden verholpen in Oracle Java SENL2026-07-22csaf · ncsc_nlNL
Oracle heeft meerdere kwetsbaarheden verholpen in Java SE (inclusief Oracle GraalVM en JavaFX componenten).
NCSC-2026-0314Kwetsbaarheden verholpen in Oracle Java SENL2026-08-19csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in Oracle Java SE, Oracle GraalVM for JDK en Oracle GraalVM Enterprise Edition.
WID-SEC-W-2026-2443Oracle Java SE: Mehrere SchwachstellenDeutsch2026-07-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Java SE ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2026-2897Oracle Java SE: Mehrere SchwachstellenDeutsch2026-08-18csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Java SE ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
BIT-java-2026-625742026-08-17vendor · osvUS
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
BIT-java-min-2026-625742026-08-17vendor · osvUS
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
BIT-jre-2026-625742026-08-17vendor · osvUS
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

also known as (6)

Other names and identifiers for this entity.

CNNVD-2026-16270801 cnnvd
EUVD-2026-47562 enisa_euvd
GHSA-5cp5-8443-8v7r enisa_euvd
BIT-java-2026-62574osv
BIT-java-min-2026-62574osv
BIT-jre-2026-62574osv

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv cert_bund ncsc_nl NVD CVE.org MITRE

published 2026-07-21modified 2026-08-18

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan