# Oracle Java SE Patches Multiple Vulnerabilities

Published: 2026-08-19 · Severity: routine · Sectors: technology
Canonical: https://vorant.io/reports/3bef3d2d-8987-5908-851f-7a9c74dd7047/oracle-java-se-patches-multiple-vulnerabilities

> Oracle patched several Java SE and GraalVM flaws that could allow remote code execution, denial of service, and data confidentiality breaches.

ANSSI-FR published an advisory covering multiple vulnerabilities in Oracle Java SE and Oracle GraalVM Enterprise Edition, disclosed as part of Oracle's August 2026 Critical Patch Update (cspuaug2026). Affected products include Java SE versions 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, and 26.0.2, as well as GraalVM Enterprise Edition 21.3.19 and GraalVM for JDK 17.0.20 and 21.0.12.

Five CVEs are referenced (CVE-2026-60589, CVE-2026-61308, CVE-2026-62574, CVE-2026-70906, CVE-2026-70907), collectively enabling remote code execution, remote denial of service, and unauthorized data confidentiality breaches. No exploitation in the wild is reported; the advisory is a standard vendor patch notification directing administrators to Oracle's security bulletin for remediation.

Given the widespread deployment of Java SE and GraalVM across enterprise environments, organizations should apply Oracle's official patches promptly to mitigate these risks, particularly where affected versions are exposed to untrusted input or network-accessible services.

## Mentioned in this report

- Vulnerabilities: CVE-2026-60589, CVE-2026-61308, CVE-2026-62574, CVE-2026-70906, CVE-2026-70907

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1048

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/3bef3d2d-8987-5908-851f-7a9c74dd7047/oracle-java-se-patches-multiple-vulnerabilities.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup