CVE-2026-60147 — openjdk: Improve certification checking (Oracle CPU 2026-07)

Back Back to CVE browser

MEDIUM

openjdk: Improve certification checking (Oracle CPU 2026-07)

Published Jul 21, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.29%

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

Affected products

Vendor Oracle Corporation Product Oracle GraalVM Enterprise Edition Default
n/a
- Version
  21.3.18
  Status
  affected
  Constraints
  -
Vendor Oracle Corporation Product Oracle GraalVM for JDK Default
n/a
- Version
  17.0.19
  Status
  affected
  Constraints
  -
- Version
  21.0.11
  Status
  affected
  Constraints
  -
Vendor Oracle Corporation Product Oracle Java SE Default
n/a
- Version
  11.0.31
  Status
  affected
  Constraints
  -
- Version
  17.0.19
  Status
  affected
  Constraints
  -
- Version
  21.0.11
  Status
  affected
  Constraints
  -
- Version
  25.0.3
  Status
  affected
  Constraints
  -
- Version
  26.0.1
  Status
  affected
  Constraints
  -
- Version
  8u491
  Status
  affected
  Constraints
  -
- Version
  8u491-perf
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Oracle Corporation

Oracle GraalVM Enterprise Edition

n/a

Version	Status	Constraints
21.3.18	affected	-

Oracle Corporation

Oracle GraalVM for JDK

n/a

Version	Status	Constraints
17.0.19	affected	-
21.0.11	affected	-

Oracle Corporation

Oracle Java SE

n/a

Version	Status	Constraints
11.0.31	affected	-
17.0.19	affected	-
21.0.11	affected	-
25.0.3	affected	-
26.0.1	affected	-
8u491	affected	-
8u491-perf	affected	-

OPENJDK ELS 11.0.32

java-11-openjdk-portable

Fixed · RHSA-2026:42881
OPENJDK ELS 11.0.32

java-11-openjdk-windows

Fixed · RHSA-2026:42882
Red Hat Enterprise Linux 10

java-21-ibm-semeru-certified-jdk-1:21.0.12.0.8-2.el10_2

Fixed · RHSA-2026:52948
Red Hat Enterprise Linux 10

java-21-openjdk-1:21.0.12.0.8-1.2.el10_2

Fixed · RHSA-2026:42895
Red Hat Enterprise Linux 10

java-25-openjdk-1:25.0.4.0.7-1.1.el10_2

Fixed · RHSA-2026:42899
Red Hat Enterprise Linux 10.0 Extended Update Support

java-21-ibm-semeru-certified-jdk-1:21.0.12.0.8-1.el10_0

Fixed · RHSA-2026:52948
Red Hat Enterprise Linux 10.0 Extended Update Support

java-21-openjdk-1:21.0.12.0.8-1.1.el10_2

Fixed · RHSA-2026:42895
Red Hat Enterprise Linux 7 Extended Lifecycle Support

java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el7_9

Fixed · RHSA-2026:42876
Red Hat Enterprise Linux 8

java-1.8.0-ibm-1:1.8.0.8.70-1.el8_10

Fixed · RHSA-2026:52949
Red Hat Enterprise Linux 8

java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el8

Fixed · RHSA-2026:42877
Red Hat Enterprise Linux 8

java-17-openjdk-1:17.0.20.0.8-1.1.el8

Fixed · RHSA-2026:42887
Red Hat Enterprise Linux 8

java-21-openjdk-1:21.0.12.0.8-1.1.el8

Fixed · RHSA-2026:42895
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el8

Fixed · RHSA-2026:42877
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

java-17-openjdk-1:17.0.20.0.8-1.1.el8

Fixed · RHSA-2026:42887
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el8

Fixed · RHSA-2026:42877
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

java-17-openjdk-1:17.0.20.0.8-1.1.el8

Fixed · RHSA-2026:42887
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el8

Fixed · RHSA-2026:42877
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

java-17-openjdk-1:17.0.20.0.8-1.1.el8

Fixed · RHSA-2026:42887
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el8

Fixed · RHSA-2026:42877
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

java-17-openjdk-1:17.0.20.0.8-1.1.el8

Fixed · RHSA-2026:42887
Red Hat Enterprise Linux 8.8 Telecommunications Update Service

java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el8

Fixed · RHSA-2026:42877
Red Hat Enterprise Linux 8.8 Telecommunications Update Service

java-17-openjdk-1:17.0.20.0.8-1.1.el8

Fixed · RHSA-2026:42887
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el8

Fixed · RHSA-2026:42877
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

java-17-openjdk-1:17.0.20.0.8-1.1.el8

Fixed · RHSA-2026:42887
Red Hat Enterprise Linux 9

java-1.8.0-openjdk-1:1.8.0.502.b07-1.2.el9

Fixed · RHSA-2026:42877
Red Hat Enterprise Linux 9

java-17-openjdk-1:17.0.20.0.8-1.2.el9

Fixed · RHSA-2026:42887
Red Hat Enterprise Linux 9

java-21-openjdk-1:21.0.12.0.8-1.2.el9

Fixed · RHSA-2026:42895
Red Hat Enterprise Linux 9

java-25-openjdk-1:25.0.4.0.7-1.1.el9

Fixed · RHSA-2026:42899
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el9

Fixed · RHSA-2026:42877
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

java-17-openjdk-1:17.0.20.0.8-1.1.el9

Fixed · RHSA-2026:42887
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el9

Fixed · RHSA-2026:42877
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

java-17-openjdk-1:17.0.20.0.8-1.1.el9

Fixed · RHSA-2026:42887
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

java-21-openjdk-1:21.0.12.0.8-1.1.el9

Fixed · RHSA-2026:42895
Red Hat Enterprise Linux 9.6 Extended Update Support

java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el9

Fixed · RHSA-2026:42877
Red Hat Enterprise Linux 9.6 Extended Update Support

java-17-openjdk-1:17.0.20.0.8-1.1.el9

Fixed · RHSA-2026:42887
Red Hat Enterprise Linux 9.6 Extended Update Support

java-21-openjdk-1:21.0.12.0.8-1.1.el9

Fixed · RHSA-2026:42895
Red Hat Hardened Images

java-21-openjdk-main-21.0.12.0.8-0.1.hum1

Fixed · RHSA-2026:50525
Red Hat Hardened Images

java-21-openjdk-portable-main-21.0.12.0.8-0.1.hum1

Fixed · RHSA-2026:50281
Red Hat Hardened Images

java-25-openjdk-main-25.0.4.0.7-1.1.1.hum1

Fixed · RHSA-2026:52834
Red Hat Hardened Images

java-25-openjdk-portable-main-25.0.4.0.7-2.0.2.hum1

Fixed · RHSA-2026:46808
Red Hat OpenJDK 11 els for RHEL 7

java-11-openjdk-1:11.0.32.0.9-1.el7_9

Fixed · RHSA-2026:42880
Red Hat OpenJDK 11 els for RHEL 8

java-11-openjdk-1:11.0.32.0.9-1.el8

Fixed · RHSA-2026:42880
Red Hat OpenJDK 11 els for RHEL 9

java-11-openjdk-1:11.0.32.0.9-1.el9

Fixed · RHSA-2026:42880
Red Hat Enterprise Linux 6

java-1.6.0-openjdk

Out of support scope
Red Hat Enterprise Linux 6

java-1.7.0-openjdk

Out of support scope
Red Hat Enterprise Linux 6

java-1.8.0-openjdk

Out of support scope
Red Hat Enterprise Linux 7

java-1.6.0-openjdk

Out of support scope
Red Hat Enterprise Linux 7

java-1.7.0-openjdk

Out of support scope

Product	Package	State	Advisory
OPENJDK ELS 11.0.32	java-11-openjdk-portable	Fixed	RHSA-2026:42881
OPENJDK ELS 11.0.32	java-11-openjdk-windows	Fixed	RHSA-2026:42882
Red Hat Enterprise Linux 10	java-21-ibm-semeru-certified-jdk-1:21.0.12.0.8-2.el10_2	Fixed	RHSA-2026:52948
Red Hat Enterprise Linux 10	java-21-openjdk-1:21.0.12.0.8-1.2.el10_2	Fixed	RHSA-2026:42895
Red Hat Enterprise Linux 10	java-25-openjdk-1:25.0.4.0.7-1.1.el10_2	Fixed	RHSA-2026:42899
Red Hat Enterprise Linux 10.0 Extended Update Support	java-21-ibm-semeru-certified-jdk-1:21.0.12.0.8-1.el10_0	Fixed	RHSA-2026:52948
Red Hat Enterprise Linux 10.0 Extended Update Support	java-21-openjdk-1:21.0.12.0.8-1.1.el10_2	Fixed	RHSA-2026:42895
Red Hat Enterprise Linux 7 Extended Lifecycle Support	java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el7_9	Fixed	RHSA-2026:42876
Red Hat Enterprise Linux 8	java-1.8.0-ibm-1:1.8.0.8.70-1.el8_10	Fixed	RHSA-2026:52949
Red Hat Enterprise Linux 8	java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el8	Fixed	RHSA-2026:42877
Red Hat Enterprise Linux 8	java-17-openjdk-1:17.0.20.0.8-1.1.el8	Fixed	RHSA-2026:42887
Red Hat Enterprise Linux 8	java-21-openjdk-1:21.0.12.0.8-1.1.el8	Fixed	RHSA-2026:42895
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el8	Fixed	RHSA-2026:42877
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	java-17-openjdk-1:17.0.20.0.8-1.1.el8	Fixed	RHSA-2026:42887
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el8	Fixed	RHSA-2026:42877
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	java-17-openjdk-1:17.0.20.0.8-1.1.el8	Fixed	RHSA-2026:42887
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el8	Fixed	RHSA-2026:42877
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	java-17-openjdk-1:17.0.20.0.8-1.1.el8	Fixed	RHSA-2026:42887
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el8	Fixed	RHSA-2026:42877
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	java-17-openjdk-1:17.0.20.0.8-1.1.el8	Fixed	RHSA-2026:42887
Red Hat Enterprise Linux 8.8 Telecommunications Update Service	java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el8	Fixed	RHSA-2026:42877
Red Hat Enterprise Linux 8.8 Telecommunications Update Service	java-17-openjdk-1:17.0.20.0.8-1.1.el8	Fixed	RHSA-2026:42887
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el8	Fixed	RHSA-2026:42877
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	java-17-openjdk-1:17.0.20.0.8-1.1.el8	Fixed	RHSA-2026:42887
Red Hat Enterprise Linux 9	java-1.8.0-openjdk-1:1.8.0.502.b07-1.2.el9	Fixed	RHSA-2026:42877
Red Hat Enterprise Linux 9	java-17-openjdk-1:17.0.20.0.8-1.2.el9	Fixed	RHSA-2026:42887
Red Hat Enterprise Linux 9	java-21-openjdk-1:21.0.12.0.8-1.2.el9	Fixed	RHSA-2026:42895
Red Hat Enterprise Linux 9	java-25-openjdk-1:25.0.4.0.7-1.1.el9	Fixed	RHSA-2026:42899
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el9	Fixed	RHSA-2026:42877
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	java-17-openjdk-1:17.0.20.0.8-1.1.el9	Fixed	RHSA-2026:42887
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el9	Fixed	RHSA-2026:42877
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	java-17-openjdk-1:17.0.20.0.8-1.1.el9	Fixed	RHSA-2026:42887
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	java-21-openjdk-1:21.0.12.0.8-1.1.el9	Fixed	RHSA-2026:42895
Red Hat Enterprise Linux 9.6 Extended Update Support	java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el9	Fixed	RHSA-2026:42877
Red Hat Enterprise Linux 9.6 Extended Update Support	java-17-openjdk-1:17.0.20.0.8-1.1.el9	Fixed	RHSA-2026:42887
Red Hat Enterprise Linux 9.6 Extended Update Support	java-21-openjdk-1:21.0.12.0.8-1.1.el9	Fixed	RHSA-2026:42895
Red Hat Hardened Images	java-21-openjdk-main-21.0.12.0.8-0.1.hum1	Fixed	RHSA-2026:50525
Red Hat Hardened Images	java-21-openjdk-portable-main-21.0.12.0.8-0.1.hum1	Fixed	RHSA-2026:50281
Red Hat Hardened Images	java-25-openjdk-main-25.0.4.0.7-1.1.1.hum1	Fixed	RHSA-2026:52834
Red Hat Hardened Images	java-25-openjdk-portable-main-25.0.4.0.7-2.0.2.hum1	Fixed	RHSA-2026:46808
Red Hat OpenJDK 11 els for RHEL 7	java-11-openjdk-1:11.0.32.0.9-1.el7_9	Fixed	RHSA-2026:42880
Red Hat OpenJDK 11 els for RHEL 8	java-11-openjdk-1:11.0.32.0.9-1.el8	Fixed	RHSA-2026:42880
Red Hat OpenJDK 11 els for RHEL 9	java-11-openjdk-1:11.0.32.0.9-1.el9	Fixed	RHSA-2026:42880
Red Hat Enterprise Linux 6	java-1.6.0-openjdk	Out of support scope	n/a
Red Hat Enterprise Linux 6	java-1.7.0-openjdk	Out of support scope	n/a
Red Hat Enterprise Linux 6	java-1.8.0-openjdk	Out of support scope	n/a
Red Hat Enterprise Linux 7	java-1.6.0-openjdk	Out of support scope	n/a
Red Hat Enterprise Linux 7	java-1.7.0-openjdk	Out of support scope	n/a

Remediation

No remediation recorded yet.

Metrics

0.29% 0.00291

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00291

Score over time

Jul–Oct 2026

EPSS v5

Percentile over time

EPSS v5

Table of values (2 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.29% (0.00291)	19.62th	v5 (v2026.06.15)
Jul 22, 2026	0.27% (0.00269)	18.87th	v5 (v2026.06.15)

Weaknesses (2)

CWE-284

CWE-295

Improper Certificate Validation

References (5)

https://access.redhat.com/security/cve/CVE-2026-60147
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2503636
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2026-60147
https://www.cve.org/CVERecord?id=CVE-2026-60147
https://www.oracle.com/security-alerts/cpujul2026.html
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-60147		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2503636		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2026-60147
https://www.cve.org/CVERecord?id=CVE-2026-60147
https://www.oracle.com/security-alerts/cpujul2026.html		vendor-advisoryVendor Advisory