CVE-2026-62574

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...

7.8 HighFix available

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.11%Unchanged since Jul 22, 2026

What each source reports

CVE List Score used 7.8

Record: CVE-2026-62574
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-284
Updated: 2026-11-02

EUVDEUVD-2026-47562 7.8

Record: EUVD-2026-47562
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-5cp5-8443-8v7r 7.8

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Record: GHSA-5cp5-8443-8v7r
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-284
Updated: 2026-11-02

NVD 7.8

Record: CVE-2026-62574
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-284
Updated: 2026-11-02

OSVALPINE-CVE-2026-62574 7.8

Record: ALPINE-CVE-2026-62574
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

OSVBIT-java-2026-62574 No score

Record: BIT-java-2026-62574
Updated: 2026-11-02

OSVBIT-java-min-2026-62574 No score

Record: BIT-java-min-2026-62574
Updated: 2026-11-02

OSVBIT-jre-2026-62574 No score

Record: BIT-jre-2026-62574
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`openjdk11` Alpine:v3.23	before 11.0.32_p9-r0	11.0.32_p9-r0
`openjdk11` Alpine:v3.24	before 11.0.32_p9-r0	11.0.32_p9-r0
`openjdk17` Alpine:v3.23	before 17.0.20_p8-r0	17.0.20_p8-r0
`openjdk17` Alpine:v3.24	before 17.0.20_p8-r0	17.0.20_p8-r0
`openjdk21` Alpine:v3.23	before 21.0.12_p8-r0	21.0.12_p8-r0
`openjdk21` Alpine:v3.24	before 21.0.12_p8-r0	21.0.12_p8-r0
`openjdk25` Alpine:v3.23	before 25.0.4_p7-r0	25.0.4_p7-r0
`openjdk25` Alpine:v3.24	before 25.0.4_p7-r0	25.0.4_p7-r0
`java` Bitnami	before 1.8.0, 1.9.0 up to 8.0.501, 9.0.0 up to 11.0.32, 12.0.0 up to 17.0.20, 18.0.0 up to 21.0.12, 22.0.0 up to 25.0.4, 26.0.0 up to 26.0.2	1.8.08.0.50111.0.3217.0.2021.0.1225.0.426.0.2
`java-min` Bitnami	before 1.8.0, 1.9.0 up to 8.0.501, 9.0.0 up to 11.0.32, 12.0.0 up to 17.0.20, 18.0.0 up to 21.0.12, 22.0.0 up to 25.0.4, 26.0.0 up to 26.0.2	1.8.08.0.50111.0.3217.0.2021.0.1225.0.426.0.2
`jre` Bitnami	before 1.8.0, 1.9.0 up to 8.0.501, 9.0.0 up to 11.0.32, 12.0.0 up to 17.0.20, 18.0.0 up to 21.0.12, 22.0.0 up to 25.0.4, 26.0.0 up to 26.0.2	1.8.08.0.50111.0.3217.0.2021.0.1225.0.426.0.2

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected, aliases, references	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-62574 is a high vulnerability (CVSS 7.8) in Oracle Graalvm, published July 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. Fixed in openjdk11 11.0.32_p9-r0.