What is the CVSS score of EUVD-2026-24343?

EUVD-2026-24343 has a CVSS 3.1 base score of 2.9 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-24343?

Yes, a patch is available for EUVD-2026-24343. Update the affected software to the latest version immediately.

Oracle Java SE EUVD-2026-24343

| CVE-2026-34268 LOW

Information Exposure (CWE-200)

2026-04-21 oracle

GHSA-xvmr-9p7m-jmwv

Java Information Disclosure Oracle Oracle Java Se Oracle Graalvm Enterprise Edition Oracle Graalvm For Jdk Oracle Corporation

2.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.9 LOW

AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

2.9 LOW

Local infrastructure logon required (AV:L), unspecified high-complexity condition (AC:H), no application privileges needed (PR:N), confidentiality-only partial impact (C:L); integrity and availability unaffected.

3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:L/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:30 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24343

CVE Published

Apr 21, 2026 - 20:35 nvd

LOW 2.9

DescriptionCVE.org

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 2.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthorized read access to a subset of JVM-accessible data is achievable in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition via a flaw in the Security component, exploitable by a local unauthenticated attacker with infrastructure logon access. The attack carries high complexity (AC:H), limiting opportunistic exploitation, and is confirmed by Oracle's April 2026 Critical Patch Update with patches available. All exploitation signals are minimal: EPSS is 0.01% at the 2nd percentile, SSVC registers exploitation as none and not automatable, and neither KEV listing nor public exploit code has been identified.

Technical ContextAI

The affected component is the Security subsystem of Oracle Java SE - responsible for cryptographic operations, access controls, and sandbox enforcement - across a broad version matrix: Java SE 8u481 through 26, GraalVM for JDK 17.0.18 and 21.0.10, and GraalVM Enterprise Edition 21.3.17 (CPE: cpe:2.3:a:oracle_corporation:oracle_java_se, cpe:2.3:a:oracle_corporation:oracle_graalvm_for_jdk, cpe:2.3:a:oracle_corporation:oracle_graalvm_enterprise_edition). The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), meaning the Security component leaks a limited subset of data to an attacker who should not have access to it. Oracle notes the flaw is reachable not only via direct JVM execution but also through APIs exposed by web services that feed data to the Security component, and through sandboxed Java Web Start applications or applets that load and execute untrusted internet-sourced code while relying on the Java sandbox for isolation.

RemediationAI

Apply Oracle's April 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpuapr2026.html; specific fixed version numbers for each Java SE and GraalVM release train are enumerated in that advisory but are not independently confirmed in the data available for this analysis - consult the CPU directly for exact upgrade targets. Ubuntu users running affected OpenJDK packages should apply the updates detailed in USN-8330-1, USN-8331-1, USN-8332-1, USN-8333-1, and USN-8334-1 via standard package management. As a compensating control where immediate patching is not feasible, restrict logon access to infrastructure hosting Java SE to trusted users only, removing or auditing any accounts capable of executing local Java workloads. Disable Java Web Start entirely if not operationally required - this eliminates the sandboxed-applet exploitation path without affecting server-side Java deployments. For web services that expose Security component APIs, consider network-layer restrictions to limit which clients can invoke those endpoints.