What is the CVSS score of EUVD-2026-46467?

EUVD-2026-46467 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for EUVD-2026-46467?

Yes, a patch is available for EUVD-2026-46467. Update the affected software to the latest version immediately.

Oracle Java SE EUVD-2026-46467

| CVE-2026-46968 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-hhf8-3x8g-6pff

Authentication Bypass Java Oracle Oracle Java Se Oracle Corporation

5.9

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Achieve network MITM position on TLS path
Delivery

Intercept active JSSE TLS session
Exploit

Send crafted TLS data to trigger authentication bypass
Execution

Inject or modify application-layer payload
Impact

Unauthorized data creation, modification, or deletion persists in target system

Vulnerability Assessment

Weakness	CWE CWE-284 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Access control enforcement MITRE ATT&CK 1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires an unauthenticated remote attacker with the ability to interact with a target system over a TLS connection - specifically via network access to a Java application whose TLS layer is handled by the affected JSSE component. A critical limiting factor is AC:H: exploitation is not straightforward and almost certainly requires the attacker to occupy a man-in-the-middle position on the TLS session or manipulate specific TLS handshake state in a non-trivial way. A second hard constraint is that the vulnerability can only be triggered by supplying data to JSSE APIs directly through a network service (e.g., a web service endpoint); it explicitly cannot be triggered via untrusted Java Web Start applications or untrusted Java applets, excluding browser-based client-side exploitation paths entirely. Scope is unchanged (S:U), meaning the compromise is bounded to the affected Java SE process and does not cascade to the underlying operating system or other applications. There is no confidentiality impact - data can only be tampered with, not disclosed. Authentication is not required (PR:N per CVSS), but the MITM prerequisite effectively substitutes as a significant technical barrier.
Impact	The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N yields a Medium score of 5.9, but the individual metrics reveal a nuanced picture. The High attack complexity (AC:H) is the primary constraint - exploitation almost certainly requires a man-in-the-middle network position or precise race/state manipulation within the TLS handshake, both of which are non-trivial to achieve opportunistically. There is no confidentiality or availability impact, limiting the blast radius to data integrity. No CISA KEV listing indicates no confirmed active exploitation campaign, and no POC code is referenced in available intelligence. EPSS data was not provided in the input and cannot be stated. The breadth of affected versions (spanning Java 8 through 26 and GraalVM) means the attack surface is enormous in theory, but real-world exploitation is gated by the MITM prerequisite, making this lower priority than a comparable AV:N/AC:L vulnerability. Organizations running Java in environments with untrusted network intermediaries (cloud load balancers, shared infrastructure, third-party CDNs) face elevated exposure. This is a genuine patch-cycle priority, not an emergency out-of-band response.
Exploit ScenarioDerived	An attacker who has achieved a man-in-the-middle position on the network path between a client and a Java application server using JSSE for TLS - for example, via ARP spoofing on a shared LAN, BGP route hijacking, or a compromised network device - sends crafted TLS data to trigger the JSSE authentication bypass. By subverting TLS-level authentication controls, the attacker injects, modifies, or deletes data exchanged via the TLS session, corrupting application-layer records, API responses, or database writes without the server or client detecting the tampering. No public exploit code has been identified at time of analysis, but the attack chain is achievable by a skilled network-level adversary.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Integrity compromise via TLS in Oracle Java SE's JSSE component allows an unauthenticated remote attacker to perform unauthorized creation, deletion, or modification of critical application data across seven affected Java SE releases and three GraalVM variants. The attack targets the TLS stack directly - not through applets or Web Start - and is tagged as an authentication bypass, suggesting the flaw undermines TLS-level authentication controls within JSSE. No public exploit code and no CISA KEV listing have been identified at time of analysis; the AC:H metric constrains real-world risk to adversaries capable of achieving precise network positioning or TLS session manipulation.

RemediationAI

Apply the patches published in Oracle's July 2026 Critical Patch Update (CPU), available at https://www.oracle.com/security-alerts/cpujul2026.html. Exact patched version numbers are not independently specified in the available data beyond the advisory; consult the CPU directly for the specific target versions for each Java SE and GraalVM release train. For GraalVM for JDK 17.0.19 and 21.0.11, and GraalVM Enterprise Edition 21.3.18, apply the corresponding CPU patches. Where patching must be deferred, consider the following specific compensating controls: restrict TLS-facing Java services to network segments where MITM interception is not feasible (e.g., enforce network segmentation, disable traffic routing through untrusted intermediaries); enforce strict mutual TLS (mTLS) with certificate pinning where supported by the application layer, which may limit the impact of JSSE-level authentication bypass; and monitor TLS handshake anomalies via network inspection tooling. These controls reduce exposure but do not eliminate the vulnerability - patching remains the definitive fix.

Affected VersionsENISA

Oracle Java SE 8u491-perf

Oracle Java SE 17.0.19

Oracle Java SE 11.0.31

Oracle Java SE 8u491

Oracle Java SE 25.0.3

Oracle Java SE 26.0.1

Oracle Java SE 21.0.11

Affected Packages

euvd oracle_java_se no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

JSSE (Java Secure Socket Extension) is Oracle's Java framework implementing TLS and SSL, responsible for handshake negotiation, certificate chain validation, cipher suite selection, and secure channel establishment. It underpins any Java application using HTTPS, LDAPS, or other TLS-wrapped protocols. The 'Authentication Bypass' tag strongly suggests the flaw lies in JSSE's certificate or session authentication logic - for example, improper validation of peer certificates during the TLS handshake, or a flaw in mutual TLS enforcement - permitting an attacker to inject or alter data as if authenticated. CWE is listed as N/A by NVD, leaving the precise root cause class (e.g., CWE-295 Improper Certificate Validation, CWE-287 Improper Authentication) unconfirmed. Affected CPE: cpe:2.3:a:oracle_corporation:oracle_java_se across the LTS train (Java 8, 11, 17, 21) and the current releases (25, 26), as well as GraalVM for JDK and GraalVM Enterprise Edition which share the same JSSE implementation.

Know when Oracle Java Se gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI 5.9 MEDIUM

Network TLS attack vector (AV:N) with high complexity MITM prerequisite (AC:H); unauthenticated; integrity-only impact matches authentication bypass with no data disclosure or service disruption.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE MEDIUM

Red Hat 5.9 MEDIUM

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

DescriptionCVE.org

Vulnerability in Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

Threat Intelligence Overview

EPSS Score

0.3%

Top 79% exploitable

Prevalence

Ubiquitous

Java SE deployed across billions of enterprise, cloud, and embedded production environments globally.

Data Quality

6 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact· derived

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +30

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Oracle Java Se

View all

CVE-2026-91403 CRITICAL Act Now POC

9.1 Oct 21

Unauthenticated remote attackers can read and tamper with critical data handled by Oracle Java SE through its JSSE (Java

CVE-2026-114820 CRITICAL Act Now

9.1 Oct 24

Remote unauthenticated compromise of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition is po

CVE-2026-47057 HIGH This Week

7.5 Jul 21

Denial-of-service in Oracle Java SE 8u491 (and 8u491-perf) and 11.0.31 lets an unauthenticated remote attacker hang or r

CVE-2026-47063 HIGH This Week

7.5 Jul 21

Unauthorized data modification in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition (Libraries component)

CVE-2026-34282 HIGH This Week

7.5 Apr 21

Denial of service in the Networking component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise E

CVE-2026-22016 HIGH This Week

7.5 Apr 21

Unauthorized data disclosure in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition arises fro

CVE-2026-47058 HIGH This Week

7.4 Jul 21

Unauthorized data access and modification in the Scripting component of Oracle Java SE 8u491, 8u491-perf, and 11.0.31 al

CVE-2026-60147 MEDIUM This Month

6.5 Jul 21

Oracle Java SE's Security component across versions 8u491 through 26.0.1 - and GraalVM for JDK/Enterprise Edition counte

CVE-2026-22003 MEDIUM This Month

6.0 Apr 21

Integrity and availability compromise in Oracle Java SE's Hotspot component affects versions 8u481 and 8u481-b50, as wel

CVE-2026-47027 MEDIUM This Month

5.3 Jul 21

Partial denial-of-service in Oracle Java SE's Libraries component allows unauthenticated network attackers to disrupt av

CVE-2026-47021 MEDIUM This Month

5.3 Jul 21

Partial denial-of-service exposure in the 2D graphics component of Oracle Java SE and GraalVM platforms allows unauthent

CVE-2026-47013 MEDIUM This Month

5.3 Jul 21

Partial denial-of-service in the JavaFX component of Oracle Java SE 8u491 is remotely exploitable by unauthenticated att

Same weakness CWE-284 – Improper Access Control

View all

CVE-2015-3306 CRITICAL POC

10.0

CVE-2012-4681 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2012-1723 CRITICAL POC

9.8

CVE-2012-5076 CRITICAL POC

9.8

CVE-2014-3120 HIGH POC

8.1

CVE-2013-2423 LOW POC

3.7

CVE-2016-3427 CRITICAL

9.8

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back