Skip to main content

Oracle Java SE CVE-2026-22013

| EUVDEUVD-2026-24321 MEDIUM
Protection Mechanism Failure (CWE-693)
2026-04-21 oracle GHSA-75hh-423h-rvwg
Authentication Bypass Java Oracle Oracle Java Se Oracle Graalvm Enterprise Edition Oracle Graalvm For Jdk Oracle Corporation
5.3
CVSS 3.1 · Vendor: oracle
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Host malicious JNLP/applet on attacker server
  2. Exploit
    Lure victim user to interact with sandboxed Java app
  3. Execution
    Trigger JGSS protection mechanism failure to bypass sandbox
  4. Impact
    Exfiltrate all JRE-accessible data to attacker

Vulnerability Assessment

Weakness
CWE
CWE-693
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
Exploitation Conditions

This vulnerability is exclusively applicable to client-side Java deployments that: (1) run sandboxed Java Web Start applications or sandboxed Java applets, (2) load and execute untrusted code sourced from the internet, and (3) rely on the Java sandbox for security isolation. It does NOT apply to the far more common server-side Java deployment model where administrators install and run only trusted code. Additionally, successful exploitation requires active human interaction from the victim - the victim must launch or interact with the attacker's malicious sandboxed application (UI:R). High attack complexity (AC:H) means specific conditions must align for exploitation to succeed; this is not a fire-and-forget attack. The effective real-world attack surface is thus limited to legacy Java SE 8 client environments still using Java Web Start or applet technology, since these mechanisms were deprecated in JDK 9 (2017) and removed in JDK 11. Java SE 11+ and GraalVM deployments are only at risk if a custom sandboxed applet framework replicating this deprecated model is in use.
Impact

Multiple risk signals converge on a lower real-world priority despite the C:H confidentiality rating. CVSS AC:H and UI:R both constrain exploitability: the attacker must achieve specific conditions and requires victim interaction with malicious content. EPSS at 0.03% (9th percentile) quantifies the low exploitation probability, and SSVC independently corroborates this with Exploitation: none and Automatable: no. The critical limiting factor, confirmed in the vendor description, is that server-side Java deployments - the dominant production use case - are explicitly not affected. The vulnerable deployment model (sandboxed Java Web Start applications and applets) has been deprecated since JDK 9 (2017) and removed entirely in JDK 11, meaning the realistic exposure is confined to legacy Java 8 client environments still running JNLP or applet workloads. CVSS reports only confidentiality impact (I:N/A:N), making this a data-theft scenario with no code execution or service disruption path. No POC is publicly available and no KEV listing exists. The 'Authentication Bypass' tag likely reflects the JGSS mechanism failing to enforce sandbox boundaries rather than a traditional credential bypass.
Exploit ScenarioDerived

An attacker hosts a malicious Java Web Start application (JNLP) or sandboxed Java applet on an attacker-controlled web server. A victim running an affected Java 8 client clicks a link or is redirected to the malicious application, satisfying the UI:R prerequisite and launching the untrusted sandboxed code. The attacker's crafted application exploits the JGSS protection mechanism failure to bypass the sandbox boundary and exfiltrate sensitive data accessible to the Java runtime - such as local files or environment variables - back to the attacker. The AC:H rating indicates specific timing or condition requirements must be met for reliable exploitation.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 24, 2026

Unauthorized full data disclosure in Oracle Java SE's JGSS component allows unauthenticated remote attackers to read all data accessible by the Java runtime, but only against sandboxed client deployments running untrusted code such as Java Web Start applications or applets. Affected releases span Oracle Java SE 8u481 through 26, GraalVM for JDK 17.0.18 and 21.0.10, and GraalVM Enterprise Edition 21.3.17. No active exploitation is confirmed - EPSS sits at 0.03% (9th percentile) and CISA has not listed this in KEV - but the confidentiality impact is rated high when exploitation conditions are met.

RemediationAI

Apply Oracle's April 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpuapr2026.html, which provides patched builds for all affected Java SE and GraalVM releases. Exact patched version numbers beyond the CPU cycle are not independently confirmed in the available data - consult the Oracle advisory for specific build identifiers. Red Hat Enterprise Linux users should apply the applicable RHSA advisories (RHSA-2026:9255, RHSA-2026:9256, and RHSA-2026:9682 through RHSA-2026:9694) via standard package management. SUSE users should apply available patches per their security notices. As a targeted compensating control that eliminates the attack surface entirely: disable or remove Java Web Start (javaws) and browser applet support on any Java 8 client systems that cannot be patched immediately, since this vulnerability does not apply to server-side deployments running only trusted code. Restricting end-user systems from loading Java content from untrusted internet sources via network policy or application allowlisting would also prevent exploitation.

Affected VersionsENISA

Oracle Java SE 11.0.30
Oracle GraalVM for JDK 17.0.18
Oracle Java SE 8u481-b50
Oracle GraalVM Enterprise Edition 21.3.17
Oracle Java SE 8u481-perf
Oracle Java SE 17.0.18
Oracle Java SE 8u481
Oracle Java SE 21.0.10
Oracle Java SE 26
Oracle Java SE 25.0.2
Oracle GraalVM for JDK 21.0.10

Affected Packages

euvd oracle_graalvm_enterprise_edition no fix
euvd oracle_graalvm_for_jdk no fix
euvd oracle_java_se no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

JGSS (Java Generic Security Services) is the Java implementation of the IETF GSS-API framework, providing a unified interface for security mechanisms including Kerberos authentication and message-level security. CWE-693 (Protection Mechanism Failure) identifies the root cause: the Java sandbox boundary that is supposed to isolate untrusted code fails to prevent that code from leveraging the JGSS subsystem to access sensitive data. CPE strings confirm three distinct product lines are affected - cpe:2.3:a:oracle_corporation:oracle_java_se, cpe:2.3:a:oracle_corporation:oracle_graalvm_for_jdk, and cpe:2.3:a:oracle_corporation:oracle_graalvm_enterprise_edition - all under Oracle's Java SE product family. The flaw is scoped entirely to client-side runtimes that enforce sandbox boundaries, not server-side JVMs running trusted administrator-installed code.

Know when Oracle Java Se gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 5.3 MEDIUM
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
vuln.today AI 5.3 MEDIUM

Network delivery requires victim interaction and specific sandboxed-client conditions (AC:H, UI:R); no privileges needed; confidentiality-only impact with no integrity or availability consequence.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.3 MEDIUM

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Patch released
Apr 28, 2026 - 08:30 nvd
Patch available
CVE Published
Apr 21, 2026 - 20:35 nvd
MEDIUM 5.3

DescriptionCVE.org

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).

Threat Intelligence Overview

EPSS Score
0.0%
Top 91% exploitable
Prevalence
Ubiquitous
Java SE deployed across virtually all enterprise and consumer environments
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact· derived
High
Technical Impact
Partial

Priority Score

26
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +26
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Oracle Java Se

View all
CVE-2026-91403 CRITICAL POC
9.1 Oct 21

Unauthenticated remote attackers can read and tamper with critical data handled by Oracle Java SE through its JSSE (Java
CVE-2026-114820 CRITICAL
9.1 Oct 24

Remote unauthenticated compromise of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition is po
CVE-2026-47057 HIGH
7.5 Jul 21

Denial-of-service in Oracle Java SE 8u491 (and 8u491-perf) and 11.0.31 lets an unauthenticated remote attacker hang or r
CVE-2026-47063 HIGH
7.5 Jul 21

Unauthorized data modification in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition (Libraries component)

CVE-2026-34282 HIGH
7.5 Apr 21

Denial of service in the Networking component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise E
CVE-2026-22016 HIGH
7.5 Apr 21

Unauthorized data disclosure in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition arises fro
CVE-2026-47058 HIGH
7.4 Jul 21

Unauthorized data access and modification in the Scripting component of Oracle Java SE 8u491, 8u491-perf, and 11.0.31 al
CVE-2026-60147 MEDIUM
6.5 Jul 21

Oracle Java SE's Security component across versions 8u491 through 26.0.1 - and GraalVM for JDK/Enterprise Edition counte
CVE-2026-22003 MEDIUM
6.0 Apr 21

Integrity and availability compromise in Oracle Java SE's Hotspot component affects versions 8u481 and 8u481-b50, as wel
CVE-2026-46968 MEDIUM
5.9 Jul 21

Integrity compromise via TLS in Oracle Java SE's JSSE component allows an unauthenticated remote attacker to perform una
CVE-2026-47027 MEDIUM
5.3 Jul 21

Partial denial-of-service in Oracle Java SE's Libraries component allows unauthenticated network attackers to disrupt av
CVE-2026-47021 MEDIUM
5.3 Jul 21

Partial denial-of-service exposure in the 2D graphics component of Oracle Java SE and GraalVM platforms allows unauthent

Same weakness CWE-693 – Protection Mechanism Failure

View all
CVE-2013-2465 CRITICAL POC
9.8
CVE-2024-21412 HIGH POC
8.1
CVE-2019-1003030 CRITICAL POC
9.9
CVE-2013-0431 LOW POC
3.7
CVE-2025-40536 HIGH POC
8.1
CVE-2024-38217 MEDIUM POC
5.4
CVE-2026-21513 HIGH
8.8
CVE-2026-21510 HIGH POC
8.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:9254 ADVISORY https://access.redhat.com/errata/RHSA-2026:9255 ADVISORY https://access.redhat.com/errata/RHSA-2026:9256 ADVISORY https://access.redhat.com/errata/RHSA-2026:9682 ADVISORY https://access.redhat.com/errata/RHSA-2026:9683 ADVISORY https://access.redhat.com/errata/RHSA-2026:9684 ADVISORY https://access.redhat.com/errata/RHSA-2026:9685 ADVISORY https://access.redhat.com/errata/RHSA-2026:9686 ADVISORY https://access.redhat.com/errata/RHSA-2026:9687 ADVISORY https://access.redhat.com/errata/RHSA-2026:9688 ADVISORY https://access.redhat.com/errata/RHSA-2026:9689 ADVISORY https://access.redhat.com/errata/RHSA-2026:9690 ADVISORY https://access.redhat.com/errata/RHSA-2026:9691 ADVISORY https://access.redhat.com/errata/RHSA-2026:9693 ADVISORY https://access.redhat.com/errata/RHSA-2026:9694 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-22013 ADVISORY https://ubuntu.com/security/notices/USN-8330-1 ADVISORY https://ubuntu.com/security/notices/USN-8331-1 ADVISORY https://ubuntu.com/security/notices/USN-8332-1 ADVISORY https://ubuntu.com/security/notices/USN-8333-1 ADVISORY https://ubuntu.com/security/notices/USN-8334-1 ADVISORY https://vuldb.com/vuln/358631 ADVISORY https://www.oracle.com/security-alerts/cpuapr2026.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy