Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify network service parsing XML
  2. Exploit
    Submit crafted XML to JAXP API
  3. Execution
    Trigger information exposure in parser
  4. Impact
    Exfiltrate unauthorized sensitive data

Vulnerability Assessment

Weakness
CWE
CWE-200
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK

2 techniques across 2 tactics: Collection, Discovery

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that the target application actually process attacker-supplied XML through the JAXP component - for example a web service or API that passes untrusted input into Java's XML parsing/transformation calls - running on one of the affected JDK/GraalVM builds. The vector is network-based, unauthenticated, and needs no user interaction (PR:N/UI:N), so no credentials are needed, but the exposure is limited to confidentiality (C:H/I:N/A:N) - no data modification or denial of service is possible. A second exposure path is legacy sandboxed Java Web Start applications or Java applets that load untrusted internet code and rely on the Java sandbox; this path is limited by the fact that Web Start and the applet plugin are deprecated/removed in current JDKs and rarely deployed. The practical limiting factor is that a runtime not exposing untrusted XML to JAXP is not reachable by this flaw.
Impact

The signals are internally consistent and point to a genuine-but-not-emergency priority. CVSS 3.1 is 7.5 driven entirely by confidentiality (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N) - network-reachable, low-complexity, no authentication or user interaction, but no integrity or availability impact and no scope change. Against that, EPSS is only 0.03% (9th percentile) and CISA's SSVC records Exploitation: none with Technical Impact: partial, so despite the 'easily exploitable' vendor phrasing there is no evidence of real-world attacks. SSVC Automatable: yes is the one elevating factor: if a working exploit emerged, the unauthenticated network vector means it could be scripted at scale, so the low EPSS reflects current absence of exploit code rather than structural difficulty. This is not in CISA KEV and no POC is known. Net: a legitimate confidentiality risk warranting patching in the normal Oracle Critical Patch Update cycle, but not a drop-everything zero-day - real risk is bounded by the fact that the runtime must actually process attacker-controlled XML through JAXP.
Exploit ScenarioDerived

An attacker sends crafted XML to a network-facing web service or API that parses it with a vulnerable JDK's JAXP stack, causing the parser to disclose sensitive data the attacker should not be able to read. No authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N), and while the vector is automatable, no public exploit code is known at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 24, 2026

Unauthorized data disclosure in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition arises from a flaw in the JAXP (Java API for XML Processing) component, allowing an unauthenticated remote attacker to read critical or all accessible data across affected JDK 8, 11, 17, 21, 25, and 26 builds. The confidentiality-only issue (CVSS 7.5, C:H/I:N/A:N) is easily exploitable over multiple network protocols, including via web services that pass attacker-supplied data into JAXP APIs, and also affects sandboxed Java Web Start/applet deployments running untrusted code. There is no public exploit identified at time of analysis and EPSS is very low (0.03%, 9th percentile), consistent with the SSVC exploitation status of 'none'.

RemediationAI

Apply the fixed releases from the Oracle Critical Patch Update of April 2026 (https://www.oracle.com/security-alerts/cpuapr2026.html); the listed versions are the vulnerable builds, so upgrade Java SE and GraalVM to the corresponding CPU-patched releases for your track (8, 11, 17, 21, 25, 26). Red Hat OpenJDK users should apply the matching errata such as RHSA-2026:9255/9256/9682-9694 (https://access.redhat.com/errata/RHSA-2026:9255). Where immediate patching is not possible and the application accepts untrusted XML, harden JAXP by disabling external DTDs and external entity resolution - set XMLConstants.FEATURE_SECURE_PROCESSING(true), and the factory features http://apache.org/xml/features/disallow-doctype-decl=true plus external-general-entities and external-parameter-entities=false, or set the jdk.xml.* system properties (e.g. jdk.xml.entityExpansionLimit) - accepting that these can break legitimate XML that relies on DTDs or external entities. For sandboxed Java Web Start/applet deployments, restrict or disable loading of untrusted code, noting that these deployment models are already deprecated/removed in modern JDKs. Restrict network exposure of any web service that funnels external XML into JAXP APIs.

Affected VersionsENISA

Oracle Java SE 21.0.10
Oracle Java SE 8u481-perf
Oracle Java SE 26
Oracle Java SE 8u481-b50
Oracle Java SE 8u481
Oracle Java SE 17.0.18
Oracle GraalVM Enterprise Edition 21.3.17
Oracle GraalVM for JDK 21.0.10
Oracle GraalVM for JDK 17.0.18
Oracle Java SE 11.0.30
Oracle Java SE 25.0.2

Affected Packages

euvd oracle_graalvm_enterprise_edition no fix
euvd oracle_graalvm_for_jdk no fix
euvd oracle_java_se no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is JAXP, the Java API for XML Processing, which provides Java's built-in XML parsing (SAX, DOM, StAX), XSLT transformation, and XPath facilities. Flaws in XML processing stacks commonly stem from external entity/DTD handling, entity expansion, or resolver behavior that lets crafted XML pull in or leak data the parser should not expose. The CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) classification and the confidentiality-only impact (C:H/I:N/A:N) indicate the root cause is information disclosure through the parser rather than code execution or data tampering. Per the CPE data, exactly three products are implicated - cpe:2.3:a:oracle_corporation:oracle_java_se, oracle_graalvm_for_jdk, and oracle_graalvm_enterprise_edition - meaning any application built on these runtimes that feeds untrusted XML into JAXP APIs (directly or via a web service) inherits the exposure.

Know when Oracle Java Se gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI 7.5 HIGH

Unauthenticated network delivery of crafted XML with low complexity and no interaction; impact is confidentiality-only per CWE-200, so I:N/A:N and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Patch released
Apr 28, 2026 - 08:30 nvd
Patch available
CVE Published
Apr 21, 2026 - 20:35 nvd
HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive ViewAI

Why It Matters

Unauthorized data disclosure vulnerability in Oracle Java SE and GraalVM (versions 8-26) allows unauthenticated attackers to extract sensitive data from applications processing XML. Any organization using affected Java versions faces potential exposure of customer data, credentials, or proprietary information through compromised web services or XML-based processing.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 91% exploitable
Prevalence
Ubiquitous
Java runtime underpins a vast fraction of enterprise server deployments
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Oracle Java Se

View all
CVE-2026-91403 CRITICAL POC
9.1 Oct 21

Unauthenticated remote attackers can read and tamper with critical data handled by Oracle Java SE through its JSSE (Java
CVE-2026-114820 CRITICAL
9.1 Oct 24

Remote unauthenticated compromise of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition is po
CVE-2026-47057 HIGH
7.5 Jul 21

Denial-of-service in Oracle Java SE 8u491 (and 8u491-perf) and 11.0.31 lets an unauthenticated remote attacker hang or r
CVE-2026-47063 HIGH
7.5 Jul 21

Unauthorized data modification in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition (Libraries component)

CVE-2026-34282 HIGH
7.5 Apr 21

Denial of service in the Networking component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise E
CVE-2026-47058 HIGH
7.4 Jul 21

Unauthorized data access and modification in the Scripting component of Oracle Java SE 8u491, 8u491-perf, and 11.0.31 al
CVE-2026-60147 MEDIUM
6.5 Jul 21

Oracle Java SE's Security component across versions 8u491 through 26.0.1 - and GraalVM for JDK/Enterprise Edition counte
CVE-2026-22003 MEDIUM
6.0 Apr 21

Integrity and availability compromise in Oracle Java SE's Hotspot component affects versions 8u481 and 8u481-b50, as wel
CVE-2026-46968 MEDIUM
5.9 Jul 21

Integrity compromise via TLS in Oracle Java SE's JSSE component allows an unauthenticated remote attacker to perform una
CVE-2026-47027 MEDIUM
5.3 Jul 21

Partial denial-of-service in Oracle Java SE's Libraries component allows unauthenticated network attackers to disrupt av
CVE-2026-47021 MEDIUM
5.3 Jul 21

Partial denial-of-service exposure in the 2D graphics component of Oracle Java SE and GraalVM platforms allows unauthent
CVE-2026-47013 MEDIUM
5.3 Jul 21

Partial denial-of-service in the JavaFX component of Oracle Java SE 8u491 is remotely exploitable by unauthenticated att

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2021-41277 HIGH POC
7.5
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:9254 ADVISORY https://access.redhat.com/errata/RHSA-2026:9255 ADVISORY https://access.redhat.com/errata/RHSA-2026:9256 ADVISORY https://access.redhat.com/errata/RHSA-2026:9682 ADVISORY https://access.redhat.com/errata/RHSA-2026:9683 ADVISORY https://access.redhat.com/errata/RHSA-2026:9684 ADVISORY https://access.redhat.com/errata/RHSA-2026:9685 ADVISORY https://access.redhat.com/errata/RHSA-2026:9686 ADVISORY https://access.redhat.com/errata/RHSA-2026:9687 ADVISORY https://access.redhat.com/errata/RHSA-2026:9688 ADVISORY https://access.redhat.com/errata/RHSA-2026:9689 ADVISORY https://access.redhat.com/errata/RHSA-2026:9690 ADVISORY https://access.redhat.com/errata/RHSA-2026:9691 ADVISORY https://access.redhat.com/errata/RHSA-2026:9693 ADVISORY https://access.redhat.com/errata/RHSA-2026:9694 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-22016 ADVISORY https://ubuntu.com/security/notices/USN-8330-1 ADVISORY https://ubuntu.com/security/notices/USN-8331-1 ADVISORY https://ubuntu.com/security/notices/USN-8332-1 ADVISORY https://ubuntu.com/security/notices/USN-8333-1 ADVISORY https://ubuntu.com/security/notices/USN-8334-1 ADVISORY https://vuldb.com/vuln/358629 ADVISORY https://www.oracle.com/security-alerts/cpuapr2026.html REF https://access.redhat.com/errata/RHSA-2026:11403 REF https://access.redhat.com/errata/RHSA-2026:11655 REF https://access.redhat.com/errata/RHSA-2026:11822 REF https://access.redhat.com/errata/RHSA-2026:11829 REF https://access.redhat.com/errata/RHSA-2026:11902 REF https://access.redhat.com/errata/RHSA-2026:22139 REF https://access.redhat.com/errata/RHSA-2026:22328 REF https://access.redhat.com/security/cve/CVE-2026-22016 REF https://bugzilla.redhat.com/show_bug.cgi?id=2460039 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22016.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy