Oracle Java SE CVE-2026-34268

The attacker must have logon access to the operating system infrastructure where Oracle Java SE or GraalVM is executing (AV:L); this is a necessary prerequisite and not just an advisory note. High attack complexity (AC:H) imposes additional conditions - likely specific timing, configuration state, or API call sequences - that must align for the vulnerability to be triggered; Oracle does not specify the exact AC:H condition. The vulnerability is also reachable in client-side Java deployments running sandboxed Java Web Start applications or sandboxed Java applets that load untrusted code from the internet - a deployment mode largely deprecated but still technically present in older Java SE versions. Exploitation requires no user interaction (UI:N) once the attacker has local access. What limits exploitation: local access to the hosting infrastructure is mandatory (no remote-only path unless via a web service API that proxies data to the Security component); attack complexity is high (not automatable per SSVC); and the confidentiality impact is restricted to a subset of JVM-accessible data rather than full system disclosure. No authentication to the Java application itself is required, but infrastructure logon is a hard prerequisite.

The aggregate risk signal across all available data sources converges on low real-world priority. The official CVSS 3.1 score of 2.9 reflects a local attack vector (AV:L), high complexity (AC:H), no required privileges (PR:N), and limited confidentiality impact (C:L) with no integrity or availability impact. EPSS at 0.01% and the 2nd percentile means fewer than 2% of known CVEs have a lower exploitation probability. SSVC confirms exploitation status as none and rates the attack as not automatable, consistent with AC:H. No CISA KEV listing and no public proof-of-concept code further reduce urgency. The only notable tension is AV:L combined with PR:N: Oracle frames 'logon to the infrastructure' as the access vector rather than a privilege, a convention consistent with their CPU methodology, but in practice an attacker needs some form of system access. This vulnerability is most relevant in multi-tenant or shared-infrastructure environments where untrusted local users can execute Java code, or in deployments still running sandboxed Java Web Start - a largely deprecated technology.

An attacker with an unprivileged OS logon on a server running Oracle Java SE crafts a specific interaction - possibly via a malicious Java applet delivered through a web service that feeds untrusted data to the Security component APIs - that satisfies the high-complexity exploitation conditions, resulting in disclosure of a limited subset of data accessible to the JVM process. No public exploit code exists, and the AC:H rating means the attacker must meet precise timing or environmental conditions, making this scenario unlikely for opportunistic actors.