Oracle Graalvm Enterprise Edition
Monthly
Unauthorized data modification in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition (Libraries component) lets a remote, unauthenticated attacker corrupt, create, or delete critical data by feeding crafted input to affected Java APIs, for example through a web service that passes data to those APIs. It carries CVSS 3.1 7.5 with an integrity-only impact (C:N/I:H/A:N) and is described by Oracle as easily exploitable over multiple network protocols. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the ubiquity of the Java runtime makes patching a priority.
Denial of service in the Networking component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows an unauthenticated, network-based attacker to cause a hang or repeatable crash (complete availability loss) of the affected runtime. The flaw is described by Oracle as easily exploitable via multiple protocols against any application that feeds attacker-controlled data to the vulnerable networking APIs (e.g., an exposed web service). There is no public exploit identified at time of analysis; EPSS is very low (0.04%, 12th percentile) and CISA SSVC lists exploitation status as none, so this is a patch-in-cycle availability issue rather than an active threat.
Unauthorized data disclosure in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition arises from a flaw in the JAXP (Java API for XML Processing) component, allowing an unauthenticated remote attacker to read critical or all accessible data across affected JDK 8, 11, 17, 21, 25, and 26 builds. The confidentiality-only issue (CVSS 7.5, C:H/I:N/A:N) is easily exploitable over multiple network protocols, including via web services that pass attacker-supplied data into JAXP APIs, and also affects sandboxed Java Web Start/applet deployments running untrusted code. There is no public exploit identified at time of analysis and EPSS is very low (0.03%, 9th percentile), consistent with the SSVC exploitation status of 'none'.
Oracle Java SE's Security component across versions 8u491 through 26.0.1 - and GraalVM for JDK/Enterprise Edition counterparts - contains an authentication bypass that allows unauthenticated network attackers to perform unauthorized read and write operations against data accessible by the Java runtime. Oracle classifies this as 'easily exploitable' via multiple protocols with no user interaction required, reachable either through server-side web services consuming Security APIs or through sandboxed Java Web Start and applet clients loading untrusted code. No public exploit code or CISA KEV listing has been identified at time of analysis, but the no-complexity network vector across a ubiquitous technology warrants priority patching.
Partial denial-of-service in the 2D component of Oracle Java SE and GraalVM platforms allows unauthenticated remote attackers to degrade availability via multiple network protocols. Affected versions span Java SE 8u491 through 26.0.1 and GraalVM for JDK 17.0.19/21.0.11, but exploitation is restricted to sandboxed client-side deployments - specifically Java Web Start applications or applets loading untrusted code - making the practical attack surface narrow given the near-obsolescence of these technologies. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Partial denial-of-service exposure in the 2D graphics component of Oracle Java SE and GraalVM platforms allows unauthenticated remote attackers to disrupt service availability with no authentication and low attack complexity. Affected releases span a broad range including Java SE 8u491 through 26.0.1, GraalVM for JDK 17.0.19 and 21.0.11, and GraalVM Enterprise Edition 21.3.18 - covering virtually every supported Java SE release as of the July 2026 CPU. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though Oracle characterizes the vulnerability as 'easily exploitable', indicating automated exploitation is plausible.
Integrity compromise in Oracle Java SE's ImageIO component allows unauthenticated remote attackers to perform unauthorized data modification against a broad range of Java SE and GraalVM versions. Exploitation requires high attack complexity, limiting opportunistic mass exploitation, but the scope spans ten distinct supported releases across Java SE 8 through 26 and both GraalVM product lines. No public exploit has been identified and this vulnerability is not listed in CISA KEV; however, the low CVSS score of 3.7 belies a moderately wide attack surface given Java's deployment footprint.
Partial denial-of-service exposure in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated remote attackers to degrade service availability by supplying malformed data via TLS. Affected releases span five Oracle Java SE versions (11.0.31 through 26.0.1) and both GraalVM product lines, as disclosed in Oracle's CPU July 2026 advisory (EUVD-2026-46459). No public exploit identified at time of analysis and no CISA KEV listing; the CVSS 5.3 rating reflects a genuine but bounded availability impact rather than a critical or confidentiality-affecting risk.
Unauthorized read access to a subset of JVM-accessible data is achievable in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition via a flaw in the Security component, exploitable by a local unauthenticated attacker with infrastructure logon access. The attack carries high complexity (AC:H), limiting opportunistic exploitation, and is confirmed by Oracle's April 2026 Critical Patch Update with patches available. All exploitation signals are minimal: EPSS is 0.01% at the 2nd percentile, SSVC registers exploitation as none and not automatable, and neither KEV listing nor public exploit code has been identified.
Uncontrolled resource consumption in Oracle Java SE's JSSE (Java Secure Socket Extension) component allows unauthenticated remote attackers to cause partial denial of service against HTTPS-enabled Java services and GraalVM deployments. Affected versions span all major Java SE release trains from 8u481 through 26, as well as GraalVM for JDK and GraalVM Enterprise Edition. Oracle confirmed the vulnerability in the April 2026 Critical Patch Update; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Partial denial-of-service exposure in the Libraries component of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition allows unauthenticated remote attackers to degrade service availability across a wide range of versions from Java 8u481 through 26. The flaw (CWE-770) can be triggered via APIs exposed by web services consuming attacker-controlled input, or through client-side Java Web Start and applet environments loading untrusted code. No active exploitation has been observed (not in CISA KEV), no public proof-of-concept has been identified, and both EPSS (0.04%, 12th percentile) and SSVC (Exploitation: none, Automatable: no) classify this as low operational urgency.
Unauthorized full data disclosure in Oracle Java SE's JGSS component allows unauthenticated remote attackers to read all data accessible by the Java runtime, but only against sandboxed client deployments running untrusted code such as Java Web Start applications or applets. Affected releases span Oracle Java SE 8u481 through 26, GraalVM for JDK 17.0.18 and 21.0.10, and GraalVM Enterprise Edition 21.3.17. No active exploitation is confirmed - EPSS sits at 0.03% (9th percentile) and CISA has not listed this in KEV - but the confidentiality impact is rated high when exploitation conditions are met.
Information disclosure in Oracle Java SE (8u481 through 26) and Oracle GraalVM (for JDK 17.0.18/21.0.10; Enterprise Edition 21.3.17) exposes a subset of data accessible to the Java process via the Security component. Exploitation requires local infrastructure logon and high attack complexity (AC:H), limiting the realistic threat surface significantly. No public exploit has been identified, EPSS is at the 2nd percentile (0.01%), and CISA SSVC classifies exploitation status as none - making this a low-priority finding despite the breadth of affected product versions.
Integrity and availability compromise in Oracle Java SE's Hotspot component affects versions 8u481 and 8u481-b50, as well as GraalVM Enterprise Edition 21.3.17, but exclusively in client-side sandboxed deployments running untrusted code via Java Web Start or applets. A low-privileged local attacker who can also induce human interaction from a third-party victim may trigger uncontrolled resource consumption (CWE-400) in Hotspot, resulting in unauthorized modification or deletion of critical data accessible to the JVM, or a complete denial of service via hang or repeatable crash. No public exploit code exists and no active exploitation has been confirmed; EPSS at 0.01% (2nd percentile) and SSVC Exploitation=none corroborate negligible current threat activity.
Unauthorized data modification in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition (Libraries component) lets a remote, unauthenticated attacker corrupt, create, or delete critical data by feeding crafted input to affected Java APIs, for example through a web service that passes data to those APIs. It carries CVSS 3.1 7.5 with an integrity-only impact (C:N/I:H/A:N) and is described by Oracle as easily exploitable over multiple network protocols. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the ubiquity of the Java runtime makes patching a priority.
Denial of service in the Networking component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows an unauthenticated, network-based attacker to cause a hang or repeatable crash (complete availability loss) of the affected runtime. The flaw is described by Oracle as easily exploitable via multiple protocols against any application that feeds attacker-controlled data to the vulnerable networking APIs (e.g., an exposed web service). There is no public exploit identified at time of analysis; EPSS is very low (0.04%, 12th percentile) and CISA SSVC lists exploitation status as none, so this is a patch-in-cycle availability issue rather than an active threat.
Unauthorized data disclosure in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition arises from a flaw in the JAXP (Java API for XML Processing) component, allowing an unauthenticated remote attacker to read critical or all accessible data across affected JDK 8, 11, 17, 21, 25, and 26 builds. The confidentiality-only issue (CVSS 7.5, C:H/I:N/A:N) is easily exploitable over multiple network protocols, including via web services that pass attacker-supplied data into JAXP APIs, and also affects sandboxed Java Web Start/applet deployments running untrusted code. There is no public exploit identified at time of analysis and EPSS is very low (0.03%, 9th percentile), consistent with the SSVC exploitation status of 'none'.
Oracle Java SE's Security component across versions 8u491 through 26.0.1 - and GraalVM for JDK/Enterprise Edition counterparts - contains an authentication bypass that allows unauthenticated network attackers to perform unauthorized read and write operations against data accessible by the Java runtime. Oracle classifies this as 'easily exploitable' via multiple protocols with no user interaction required, reachable either through server-side web services consuming Security APIs or through sandboxed Java Web Start and applet clients loading untrusted code. No public exploit code or CISA KEV listing has been identified at time of analysis, but the no-complexity network vector across a ubiquitous technology warrants priority patching.
Partial denial-of-service in the 2D component of Oracle Java SE and GraalVM platforms allows unauthenticated remote attackers to degrade availability via multiple network protocols. Affected versions span Java SE 8u491 through 26.0.1 and GraalVM for JDK 17.0.19/21.0.11, but exploitation is restricted to sandboxed client-side deployments - specifically Java Web Start applications or applets loading untrusted code - making the practical attack surface narrow given the near-obsolescence of these technologies. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Partial denial-of-service exposure in the 2D graphics component of Oracle Java SE and GraalVM platforms allows unauthenticated remote attackers to disrupt service availability with no authentication and low attack complexity. Affected releases span a broad range including Java SE 8u491 through 26.0.1, GraalVM for JDK 17.0.19 and 21.0.11, and GraalVM Enterprise Edition 21.3.18 - covering virtually every supported Java SE release as of the July 2026 CPU. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though Oracle characterizes the vulnerability as 'easily exploitable', indicating automated exploitation is plausible.
Integrity compromise in Oracle Java SE's ImageIO component allows unauthenticated remote attackers to perform unauthorized data modification against a broad range of Java SE and GraalVM versions. Exploitation requires high attack complexity, limiting opportunistic mass exploitation, but the scope spans ten distinct supported releases across Java SE 8 through 26 and both GraalVM product lines. No public exploit has been identified and this vulnerability is not listed in CISA KEV; however, the low CVSS score of 3.7 belies a moderately wide attack surface given Java's deployment footprint.
Partial denial-of-service exposure in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated remote attackers to degrade service availability by supplying malformed data via TLS. Affected releases span five Oracle Java SE versions (11.0.31 through 26.0.1) and both GraalVM product lines, as disclosed in Oracle's CPU July 2026 advisory (EUVD-2026-46459). No public exploit identified at time of analysis and no CISA KEV listing; the CVSS 5.3 rating reflects a genuine but bounded availability impact rather than a critical or confidentiality-affecting risk.
Unauthorized read access to a subset of JVM-accessible data is achievable in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition via a flaw in the Security component, exploitable by a local unauthenticated attacker with infrastructure logon access. The attack carries high complexity (AC:H), limiting opportunistic exploitation, and is confirmed by Oracle's April 2026 Critical Patch Update with patches available. All exploitation signals are minimal: EPSS is 0.01% at the 2nd percentile, SSVC registers exploitation as none and not automatable, and neither KEV listing nor public exploit code has been identified.
Uncontrolled resource consumption in Oracle Java SE's JSSE (Java Secure Socket Extension) component allows unauthenticated remote attackers to cause partial denial of service against HTTPS-enabled Java services and GraalVM deployments. Affected versions span all major Java SE release trains from 8u481 through 26, as well as GraalVM for JDK and GraalVM Enterprise Edition. Oracle confirmed the vulnerability in the April 2026 Critical Patch Update; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Partial denial-of-service exposure in the Libraries component of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition allows unauthenticated remote attackers to degrade service availability across a wide range of versions from Java 8u481 through 26. The flaw (CWE-770) can be triggered via APIs exposed by web services consuming attacker-controlled input, or through client-side Java Web Start and applet environments loading untrusted code. No active exploitation has been observed (not in CISA KEV), no public proof-of-concept has been identified, and both EPSS (0.04%, 12th percentile) and SSVC (Exploitation: none, Automatable: no) classify this as low operational urgency.
Unauthorized full data disclosure in Oracle Java SE's JGSS component allows unauthenticated remote attackers to read all data accessible by the Java runtime, but only against sandboxed client deployments running untrusted code such as Java Web Start applications or applets. Affected releases span Oracle Java SE 8u481 through 26, GraalVM for JDK 17.0.18 and 21.0.10, and GraalVM Enterprise Edition 21.3.17. No active exploitation is confirmed - EPSS sits at 0.03% (9th percentile) and CISA has not listed this in KEV - but the confidentiality impact is rated high when exploitation conditions are met.
Information disclosure in Oracle Java SE (8u481 through 26) and Oracle GraalVM (for JDK 17.0.18/21.0.10; Enterprise Edition 21.3.17) exposes a subset of data accessible to the Java process via the Security component. Exploitation requires local infrastructure logon and high attack complexity (AC:H), limiting the realistic threat surface significantly. No public exploit has been identified, EPSS is at the 2nd percentile (0.01%), and CISA SSVC classifies exploitation status as none - making this a low-priority finding despite the breadth of affected product versions.
Integrity and availability compromise in Oracle Java SE's Hotspot component affects versions 8u481 and 8u481-b50, as well as GraalVM Enterprise Edition 21.3.17, but exclusively in client-side sandboxed deployments running untrusted code via Java Web Start or applets. A low-privileged local attacker who can also induce human interaction from a third-party victim may trigger uncontrolled resource consumption (CWE-400) in Hotspot, resulting in unauthorized modification or deletion of critical data accessible to the JVM, or a complete denial of service via hang or repeatable crash. No public exploit code exists and no active exploitation has been confirmed; EPSS at 0.01% (2nd percentile) and SSVC Exploitation=none corroborate negligible current threat activity.