CVE-2026-114820VulnerabilityPublished 10/24/2026

CVE-2026-114820: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete

Affects Oracle Corporation Oracle Java SESource CVE Database V5

Not known to be exploited · CVSS 9.1 Critical : monitor for a fix to Oracle Corporation Oracle Java SE.

Data as of 10/24/2026, 20:28:43 UTC

CVSS 3.1 base score

9.1Critical

How severe the flaw is on the 0–10 CVSS scale.

Exploitation: Not in CISA KEV, no exploitation reported

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

What to do

Affected software

Product	Affected	Fixed in
Oracle CorporationOracle Java SE	Affected =8u511-b32 =8u511-perf-b32 =11.0.33.0.2 =17.0.21.0.2 =21.0.13.0.2 =25.0.5.0.2 =27.0.1.0.2	Fixed in–
Oracle CorporationOracle GraalVM for JDK	Affected =17.0.21.0.2 =21.0.13.0.2	Fixed in–
Oracle CorporationOracle GraalVM Enterprise Edition	Affected =21.3.20.0.2	Fixed in–
Mavencom.oracle.java/java-se`pkg:maven/com.oracle.java/java-se`Other threats	Affected =8u511-b32 =8u511-perf-b32 =11.0.33.0.2 =17.0.21.0.2 =21.0.13.0.2 =25.0.5.0.2 =27.0.1.0.2 =21.3.20.0.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Oracle has released security updates that remove the impacted root CA certificates related to eMudhra to address this vulnerability. Users should update to the latest Java versions as specified in the Oracle advisory or apply the recommended mitigations detailed in the official Oracle Security Alert (https://www.oracle.com/security-alerts/alert-cve-2026-114820.html). No additional action is required beyond applying these updates or mitigations.

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Impact

An unauthenticated attacker with network access can exploit this vulnerability to gain unauthorized creation, deletion, or modification access to critical data accessible by the affected Oracle Java SE and GraalVM products. The confidentiality and integrity of data can be severely compromised, potentially leading to complete unauthorized access to all accessible data. There is no impact on availability. The vulnerability affects multiple protocols and can be exploited remotely without user interaction or privileges.

Summary

This vulnerability in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows remote, unauthenticated attackers to exploit multiple network protocols to gain unauthorized access to critical data. The flaw affects specific versions of these products, including Oracle Java SE versions 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, and 27.0.1.0.2; Oracle GraalVM for JDK versions 17.0.21.0.2 and 21.0.13.0.2; and Oracle GraalVM Enterprise Edition version 21.3.20.0.2. Exploitation can occur via APIs, including web services, and affects Java clients running sandboxed applications that load untrusted code relying on the Java sandbox. Oracle's advisory indicates the vulnerability is addressed by removing impacted root CA certificates related to eMudhra and recommends updating to the latest Java versions or applying the recommended mitigations.

Weaknesses

CWE-327Use of a Broken or Risky Cryptographic Algorithm (opens in a new tab)
Class weaknessLikelihood of exploit: HighOWASP Top 10 A04:2025: Cryptographic Failures (opens in a new tab)
The product uses a broken or risky cryptographic algorithm or protocol.
Architecture and Design · Libraries or Frameworks
When there is a need to store or transmit sensitive data, use strong, up-to-date cryptographic algorithms to encrypt that data. Select a well-vetted algorithm that is currently considered to be strong by experts in the field, and use well-tested implementations.
Architecture and Design
Ensure that the design allows one cryptographic algorithm to be replaced with another in the next generation or version. Where possible, use wrappers to make the interfaces uniform. This will make it easier to upgrade to stronger algorithms.
Architecture and Design
Carefully manage and protect cryptographic keys (see CWE-320). If the keys can be guessed or stolen, then the strength of the cryptography itself is irrelevant.
OWASP Cheat Sheets
Cryptographic Storage (opens in a new tab)
Key Management (opens in a new tab)
Transport Layer Protection (opens in a new tab)
User Privacy Protection (opens in a new tab)
Password Storage (opens in a new tab)
OWASP ASVS 4.0.3
V8.3.7 (opens in a new tab)
V2.9.3 (opens in a new tab)
V6.2.2 (opens in a new tab)
Attack patterns
Encryption Brute Forcing (opens in a new tab)
Creating a Rogue Certification Authority Certificate (opens in a new tab)
Signature Spoof (opens in a new tab)
Signature Spoofing by Improper Validation (opens in a new tab)
Cryptanalysis of Cellular Encryption (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

oracle.com/security-alerts/alert-cve-2026-114820.html (opens in a new tab)

Community reviews

Loading reviews…