Skip to main content

Oracle Java SE CVE-2026-46968

| EUVDEUVD-2026-46467 MEDIUM
Improper Access Control (CWE-284)
2026-07-21 oracle GHSA-hhf8-3x8g-6pff
Authentication Bypass Java Oracle Oracle Java Se Oracle Corporation
5.9
CVSS 3.1 · Vendor: oracle
Share

Severity by source

Vendor (oracle) PRIMARY
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
vuln.today AI
5.9 MEDIUM

Network TLS attack vector (AV:N) with high complexity MITM prerequisite (AC:H); unauthenticated; integrity-only impact matches authentication bypass with no data disclosure or service disruption.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.9 MEDIUM
qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

2
Analysis Generated
Jul 22, 2026 - 02:00 vuln.today
CVE Published
Jul 21, 2026 - 21:32 nvd
MEDIUM 5.9

DescriptionCVE.org

Vulnerability in Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

AnalysisAI

Integrity compromise via TLS in Oracle Java SE's JSSE component allows an unauthenticated remote attacker to perform unauthorized creation, deletion, or modification of critical application data across seven affected Java SE releases and three GraalVM variants. The attack targets the TLS stack directly - not through applets or Web Start - and is tagged as an authentication bypass, suggesting the flaw undermines TLS-level authentication controls within JSSE. No public exploit code and no CISA KEV listing have been identified at time of analysis; the AC:H metric constrains real-world risk to adversaries capable of achieving precise network positioning or TLS session manipulation.

Technical ContextAI

JSSE (Java Secure Socket Extension) is Oracle's Java framework implementing TLS and SSL, responsible for handshake negotiation, certificate chain validation, cipher suite selection, and secure channel establishment. It underpins any Java application using HTTPS, LDAPS, or other TLS-wrapped protocols. The 'Authentication Bypass' tag strongly suggests the flaw lies in JSSE's certificate or session authentication logic - for example, improper validation of peer certificates during the TLS handshake, or a flaw in mutual TLS enforcement - permitting an attacker to inject or alter data as if authenticated. CWE is listed as N/A by NVD, leaving the precise root cause class (e.g., CWE-295 Improper Certificate Validation, CWE-287 Improper Authentication) unconfirmed. Affected CPE: cpe:2.3:a:oracle_corporation:oracle_java_se across the LTS train (Java 8, 11, 17, 21) and the current releases (25, 26), as well as GraalVM for JDK and GraalVM Enterprise Edition which share the same JSSE implementation.

RemediationAI

Apply the patches published in Oracle's July 2026 Critical Patch Update (CPU), available at https://www.oracle.com/security-alerts/cpujul2026.html. Exact patched version numbers are not independently specified in the available data beyond the advisory; consult the CPU directly for the specific target versions for each Java SE and GraalVM release train. For GraalVM for JDK 17.0.19 and 21.0.11, and GraalVM Enterprise Edition 21.3.18, apply the corresponding CPU patches. Where patching must be deferred, consider the following specific compensating controls: restrict TLS-facing Java services to network segments where MITM interception is not feasible (e.g., enforce network segmentation, disable traffic routing through untrusted intermediaries); enforce strict mutual TLS (mTLS) with certificate pinning where supported by the application layer, which may limit the impact of JSSE-level authentication bypass; and monitor TLS handshake anomalies via network inspection tooling. These controls reduce exposure but do not eliminate the vulnerability - patching remains the definitive fix.

More in Java

View all
CVE-2012-4681 CRITICAL POC
9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
CVE-2015-7450 CRITICAL POC
9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
CVE-2013-2465 CRITICAL POC
9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2010-1871 HIGH POC
8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
CVE-2012-1723 CRITICAL POC
9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2012-0507 CRITICAL POC
9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
CVE-2015-4852 CRITICAL POC
9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL POC
9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
CVE-2017-3066 CRITICAL POC
9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
CVE-2012-0391 CRITICAL POC
9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected

Share

CVE-2026-46968 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy