What is the CVSS score of CVE-2026-22008?

CVE-2026-22008 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-22008?

Yes, a patch is available for CVE-2026-22008. Update the affected software to the latest version immediately.

Oracle Java SE CVE-2026-22008

EUVD-2026-24313 LOW

Execution with Unnecessary Privileges (CWE-250)

2026-04-21 oracle

Privilege Escalation Java Oracle Oracle Java Se Oracle Corporation

3.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

3.1 LOW

UI:R assigned because the attack requires a victim user to actively load and execute attacker-supplied sandboxed code; remaining metrics align with vendor assessment.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:35 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24313

CVE Published

Apr 21, 2026 - 20:35 nvd

LOW 3.7

DescriptionCVE.org

Vulnerability in Oracle Java SE (component: Libraries). The supported version that is affected is Oracle Java SE: 25.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

AnalysisAI

Oracle Java SE 25.0.1 exposes an integrity-bypass in its Libraries component that allows a remote unauthenticated attacker, via multiple protocols, to perform unauthorized data writes against accessible Java SE data. The attack is constrained to client-side deployments - specifically sandboxed Java Web Start applications and sandboxed Java applets loading untrusted internet code - and carries a vendor-assigned CVSS 3.7 (Low). No active exploitation is confirmed (SSVC: none, EPSS: 0.03%), and a vendor patch is available via the April 2026 Oracle Critical Patch Update.

Technical ContextAI

The affected component is Oracle Java SE's core Libraries module, present in release 25.0.1 (CPE: cpe:2.3:a:oracle_corporation:oracle_java_se:*:*:*:*:*:*:*:*). The root cause is classified as CWE-250 - Execution with Unnecessary Privileges - meaning the sandbox enforcement mechanism grants or retains elevated privileges during code execution that are not required for the operation, allowing untrusted code to perform integrity-affecting actions beyond what its trust level should permit. The vulnerability is reachable over the network via multiple protocols (e.g., HTTP, JNLP) because the attack path begins when a victim client fetches and runs attacker-supplied code. This is architecturally a sandbox escape vector, not a server-side deserialization or RCE class issue. The Ubuntu USN-8334-1 notice and Oracle's CPUApr2026 advisory confirm the package and version scope.

RemediationAI

The primary fix is to upgrade Oracle Java SE to a version provided in or after the April 2026 Critical Patch Update, available via Oracle's release portal and referenced at https://www.oracle.com/security-alerts/cpuapr2026.html. Ubuntu users should apply the patched package addressed in USN-8334-1 (https://ubuntu.com/security/notices/USN-8334-1). If immediate patching is not possible, the most effective compensating control is to disable Java Web Start and Java applet execution in client browsers and JVM configurations - this eliminates the attack surface entirely because the vulnerability does not apply to server-side or trusted-code deployments. Restricting outbound network access from client JVMs to prevent loading of untrusted code from the internet is an additional layer but does not eliminate risk from compromised internal content sources. No patch version number beyond the CPUApr2026 cycle identifier is independently confirmed from the available input data.