CVE-2026-22003 is a medium severity vulnerability in the Hotspot component of Oracle Java SE and Oracle GraalVM Enterprise Edition versions 8u481 and 8u481-b50. It permits a low privileged attacker with infrastructure logon to compromise the Java runtime environment, contingent on human interaction by a third party. The vulnerability affects sandboxed Java deployments that execute untrusted code, potentially allowing unauthorized modification or deletion of critical data and causing denial of service through hangs or crashes. It does not affect server-side deployments running only trusted code. The CVSS vector indicates local attack vector, high attack complexity, low privileges required, user interaction required, unchanged scope, no confidentiality impact, but high integrity and availability impacts. Oracle's April 2026 Critical Patch Update advisory references this vulnerability among many others but does not provide a standalone patch link. Customers should apply the cumulative patches provided in the update.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical or accessible data within Oracle Java SE or Oracle GraalVM Enterprise Edition environments. Additionally, it can cause the Java runtime to hang or crash repeatedly, leading to a complete denial of service. The vulnerability requires local access with low privileges and user interaction, limiting the ease of exploitation. There is no confidentiality impact reported. No known exploits in the wild have been documented.

Oracle includes this vulnerability in its April 2026 Critical Patch Update, which contains numerous security patches across multiple products. While no specific patch link for CVE-2026-22003 is provided, Oracle strongly recommends applying the April 2026 Critical Patch Update promptly to mitigate this and other vulnerabilities. Customers should ensure they remain on actively supported versions and apply all relevant patches without delay. Since this vulnerability requires user interaction and local access, limiting such access and educating users about social engineering risks can also help reduce exposure. Patch status beyond the advisory is not explicitly confirmed; therefore, check the Oracle advisory at https://www.oracle.com/security-alerts/cpuapr2026.html for the latest remediation guidance.