CVE-2026-22013 is a vulnerability in the JGSS component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition affecting versions including Java SE 8u481 through 26 and GraalVM versions 17.0.18 and 21.0.10. The flaw allows an unauthenticated attacker with network access via multiple protocols to compromise the affected products by exploiting a scenario that requires user interaction from someone other than the attacker. The vulnerability applies to client-side Java deployments that load and run untrusted code in sandboxed environments, such as Java Web Start applications or applets, relying on the Java sandbox for security. Server-side deployments running only trusted code are not affected. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a network attack vector with high attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact without integrity or availability impact. Oracle’s April 2026 Critical Patch Update advisory references this vulnerability among 481 security patches but does not explicitly confirm patch availability for this specific issue, advising customers to apply updates promptly.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition environments. The vulnerability affects confidentiality but does not impact integrity or availability. Exploitation requires network access and user interaction from a third party, making it difficult to exploit. It primarily affects client-side Java deployments running untrusted code in sandboxed environments, not server-side trusted code deployments.

Oracle strongly recommends applying the April 2026 Critical Patch Update, which includes security patches addressing this vulnerability among many others. Since the vendor advisory does not explicitly confirm patch availability for this specific vulnerability, users should verify patch status and installation instructions in the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpuapr2026.html. Maintaining up-to-date patches on actively supported versions is the primary mitigation. No alternative mitigations or 'no action required' statements are provided by the vendor.