Oracle Java SE CVE-2026-22007

Exploitation requires a local OS-level logon session on the infrastructure where the affected Oracle Java SE or GraalVM instance executes (AV:L) - remote network exploitation is not possible. High attack complexity (AC:H) imposes additional non-trivial preconditions such as race conditions or specific environmental state that must align, which the advisory does not enumerate in detail. No Java-level privileges are required (PR:N per CVSS), meaning any user with an OS logon suffices. A secondary exploitation path exists specifically for client-side deployments: sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code from the internet, where the sandbox is expected to enforce isolation. Exploitation is strictly limited to partial confidentiality loss - no integrity or availability impact is possible. The attack is classified as not automatable by SSVC, ruling out scripted mass exploitation.

All available signals consistently indicate low real-world risk. The CVSS 3.1 base score of 2.9 reflects the three primary dampening factors: local-only attack vector (AV:L), high attack complexity (AC:H), and impact limited solely to partial confidentiality (C:L/I:N/A:N). EPSS at 0.01% places this in the 2nd percentile of all CVEs for exploitation probability - essentially negligible. CISA SSVC corroborates this: exploitation status is none, the attack is not automatable, and technical impact is partial. There is no CISA KEV listing and no public POC identified. The CVSS PR:N metric may appear to conflict with the requirement for local logon access, but the description clarifies this correctly: no Java-level privileges are needed, only an OS-level session on the host. This is not a remotely exploitable vulnerability in the conventional sense. Defenders should patch as part of normal Oracle CPU cycles rather than treating this as an emergency.

An attacker who has obtained a local OS session on a host running an affected Oracle Java SE or GraalVM version - through credential theft, insider access, or lateral movement - invokes APIs within the Java Security component, either directly or through a web service that passes attacker-controlled data to those APIs. The high attack complexity means specific environmental conditions (such as race conditions or precise state alignment) must be satisfied, limiting opportunistic exploitation. Success results only in reading a limited subset of data accessible to the Java process; no code execution, data modification, or denial of service is achievable through this path.