Which versions of Java are affected by CVE-2026-4217?

CVE-2026-4217 is a low-severity vulnerability in XREAL Nebula App (CVSS 2.5). The limited severity suggests constrained impact, typically requiring specific conditions or local access for…

Is there a public PoC exploit available for CVE-2026-4217?

Yes, a public proof-of-concept exploit is available for CVE-2026-4217. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4217?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Java CVE-2026-4217

Q: What is the CVSS score of CVE-2026-4217?

CVE-2026-4217 has a CVSS 4.0 base score of 1.1 (Low). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12337 LOW

Key Management Errors (CWE-320)

2026-03-16 VulDB

Java Google Information Disclosure

1.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.1 LOW

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

2.0 (LOW) 1.1 (LOW)

CVSS changed

Apr 22, 2026 - 21:37 NVD

2.5 (LOW) 2.0 (LOW)

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 16, 2026 - 06:00 euvd

EUVD-2026-12337

Analysis Generated

Mar 16, 2026 - 06:00 vuln.today

CVE Published

Mar 16, 2026 - 05:02 nvd

LOW 2.5

DescriptionCVE.org

A security vulnerability has been detected in XREAL Nebula App up to 3.2.1 on Android. This impacts an unknown function of the file in ai/nreal/nebula/flutterPlugin/CloudStoragePlugin.java of the component ai.nreal.nebula.universal. Such manipulation of the argument accessKey/secretAccessKey/securityToken leads to key management error. The attack can only be performed from a local environment. The attack requires a high level of complexity. The exploitability is said to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

A key management error exists in the XREAL Nebula App (Android) up to version 3.2.1, specifically in the CloudStoragePlugin.java component where accessKey, secretAccessKey, and securityToken arguments are improperly handled. An attacker with local access and moderate privileges can manipulate these credentials to bypass authentication controls, resulting in unauthorized information disclosure. A proof-of-concept has been publicly disclosed, though the vulnerability requires high complexity to exploit and the vendor has not responded to early notification.

Technical ContextAI

The vulnerability resides in the ai.nreal.nebula.universal component's CloudStoragePlugin.java file, which handles cloud storage credential management for the XREAL Nebula App on Android. The root cause is classified under CWE-320 (Key Management Errors), indicating improper storage, validation, or handling of cryptographic keys and authentication tokens. The plugin fails to adequately protect sensitive credential arguments (accessKey, secretAccessKey, securityToken) during processing, likely due to insufficient input validation or insecure credential handling patterns. This affects the cloud storage integration layer of the Nebula AR platform, which manages user authentication to backend services.

RemediationAI

Users of XREAL Nebula App should upgrade to a version newer than 3.2.1 as soon as available from the official Google Play Store or XREAL's distribution channel; however, check the XREAL website or support channels for the latest patched version number, as the vendor has not publicly announced a fix timeline. As an interim mitigation, users should restrict installation of untrusted applications on devices running XREAL Nebula, disable developer options that expose credential handling, and avoid using shared Android devices for sensitive cloud storage operations. Organizations using XREAL Nebula should monitor their environment for unusual credential access patterns and consider isolating Nebula sessions to dedicated devices until a patch is confirmed available.