Database Management

Why SolarWinds Database Performance Analyzer (DPA) is not affected by multiple Oracle Java vulnerabilities

This article explains why SolarWinds Database Performance Analyzer (DPA) is not affected by the following Oracle Java vulnerabilities: CVE-2026-60589 CVE-2026-70907 CVE-2026-61308 CVE-2026-70906

First published date

9/15/2026 3:12 PM

Last published date

9/15/2026 3:12 PM

Overview

In 2026, the National Institute of Standards and Technology (NIST) published security bulletins about the following Oracle Java vulnerabilities:

Product section

Database Performance Analyzer

Cause

CVE-2026-60589 is a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.

CVE-2026-70907 is a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.

CVE-2026-61308 is a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.

CVE-2026-70906 is a vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 25.0.4 and 26.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE.

Resolution

SolarWinds Database Performance Analyzer (DPA) is not affected by CVE-2026-60589, CVE-2026-70907, CVE-2026-61308, and CVE-2026-70906.

CVE-2026-70906: DPA is using a JDK version that is not in the affected list.

CVE-2026-70907, CVE-2026-61308, CVE-2026-60589: The secure configuration guide for DPA recommends that the application should only be deployed in internal environments and not exposed to the public internet. DPA does not have any web service or API that accepts and forwards arbitrary untrusted internet-sourced data into these specific JDK components, therefore DPA is not affected by these vulnerabilities.

DPA Secure Configuration Guide: Best Practices and Recommendations

While the component’s presence is flagged by dependency scanning tools, our analysis shows there is no associated security risk.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.