What is the CVSS score of CVE-2026-21932?

CVE-2026-21932 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-21932?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Java CVE-2026-21932

HIGH

Improper Validation of Specified Type of Input (CWE-1287)

2026-01-20 secalert_us@oracle.com

Authentication Bypass Java Oracle Graalvm Graalvm For Jdk Jdk Jre

7.4

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft malicious AWT/JavaFX content
Exploit

Deliver via network protocol
Execution

User interacts with rendered content
Impact

Integrity compromise occurs

Vulnerability Assessment

Weakness	CWE CWE-1287 ASVS 5.0 V2 - Validation and Business Logic Specified type validation
Exploitation Conditions	Oracle Java SE (versions 8u471, 11.0.29, 17.0.17, 21.0.9, 25.0.1), Oracle GraalVM for JDK (17.0.17, 21.0.9), or Oracle GraalVM Enterprise Edition (21.3.16) with AWT/JavaFX components enabled. Requires user interaction with malicious graphical content delivered over network.
Impact	CVSS 7.4 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: Required. Exploitation no authentication required. Exploitable via remote/network.
Exploit ScenarioDerived	A remote attacker without authentication could exploit this vulnerability to unauthorized creation, deletion or modification access to critical data or all O.

Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Graalvm versions up to 21.3.16 contains a vulnerability that allows attackers to unauthorized creation, deletion or modification access to critical data or all O (CVSS 7.4).

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

affects Graalvm. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Orac

Know when Java gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

SUSE HIGH

Red Hat 7.4 HIGH

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 09, 2026 - 14:30 nvd

Patch available

CVE Published

Jan 20, 2026 - 22:15 nvd

HIGH 7.4

DescriptionCVE.org

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).

Executive ViewAI

Why It Matters

CVE-2026-21932 presents moderate security risk rated CVSS 7.4. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and consider compensating controls in the interim.

Business Impact: Moderate

Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score

0.0%

Top 92% exploitable

Threat Intel

1 source

Data Quality

6 sources

Confidence: High

NVD

CVE.org

EPSS CISA Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat Yes

Deciding rule

Active threat signals + CRITICAL/HIGH severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +37

PoC: 0

Weaponized: 0

Threat intel: +10

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)CVE.org

cpe:2.3:a:oracle:graalvm:21.3.16:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:graalvm_for_jdk:17.0.17:*:*:*:*:*:*:*

cpe:2.3:a:oracle:graalvm_for_jdk:21.0.9:*:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.8.0:update471:*:*:-:*:*:*

cpe:2.3:a:oracle:jdk:1.8.0:update471:*:*:enterprise_performance_pack:*:*:*

cpe:2.3:a:oracle:jdk:1.8.0:update471_b50:*:*:-:*:*:*

cpe:2.3:a:oracle:jdk:11.0.29:*:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:17.0.17:*:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:21.0.9:*:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:25.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.8.0:update471:*:*:-:*:*:*

cpe:2.3:a:oracle:jre:1.8.0:update471:*:*:enterprise_performance_pack:*:*:*

cpe:2.3:a:oracle:jre:1.8.0:update471_b50:*:*:-:*:*:*

cpe:2.3:a:oracle:jre:11.0.29:*:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:17.0.17:*:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:21.0.9:*:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:25.0.1:*:*:*:*:*:*:*

More in Java

View all

CVE-2012-4681 CRITICAL Emergency POC

9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m

CVE-2015-7450 CRITICAL Emergency POC

9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti

CVE-2013-2465 CRITICAL Act Now POC

9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent

CVE-2011-3544 CRITICAL Act Now POC

9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug

CVE-2010-1871 HIGH Act Now POC

8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to

CVE-2012-1723 CRITICAL Emergency POC

9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up

CVE-2013-0422 CRITICAL Emergency POC

9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using

CVE-2012-0507 CRITICAL Emergency POC

9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up

CVE-2015-4852 CRITICAL Act Now POC

9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL Act Now POC

9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow

CVE-2017-3066 CRITICAL Act Now POC

9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla

CVE-2012-0391 CRITICAL Act Now POC

9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-1287 – Improper Validation of Specified Type of Input

View all

CVE-2024-6298 CRITICAL POC

9.4

CVE-2024-4879 CRITICAL POC

9.3

CVE-2025-46342 HIGH POC

8.5

CVE-2026-107723 HIGH POC

8.1

CVE-2025-32442 HIGH POC

7.5

CVE-2024-3175 MEDIUM POC

6.3

CVE-2019-25596 MEDIUM POC

6.2

CVE-2026-80051 MEDIUM POC

5.9

Same technique Authentication Bypass

View all

CVE-2015-3306 CRITICAL POC

10.0

CVE-2023-22515 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

Vendor StatusVendor

SUSE

Severity: High

Product	Status
Container suse/manager/5.0/x86_64/server-attestation:latest	Affected
Container suse/manager/5.0/x86_64/server:latest Container suse/multi-linux-manager/5.1/x86_64/server:5.1.2.8.13.2 Image server-image	Affected
Container suse/multi-linux-manager/5.1/x86_64/server-attestation:5.1.2.8.15.2 Image server-attestation-image	Affected
Image SLES15-SP5-SAP-Azure-LI-BYOS Image SLES15-SP5-SAP-Azure-LI-BYOS-Production Image SLES15-SP5-SAP-Azure-VLI-BYOS Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production	Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7	Fixed

Threat IntelligenceMISP

CISA Advisories

ICSA-26-134-10

Sources: CISA (public domain)

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back