This vulnerability affects Oracle Java SE versions 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, and 26; Oracle GraalVM for JDK versions 17.0.18 and 21.0.10; and Oracle GraalVM Enterprise Edition version 21.3.17. It resides in the JAXP component and allows an unauthenticated attacker with network access via multiple protocols to compromise the affected products, resulting in unauthorized access to critical or all accessible data. The vulnerability can be exploited via APIs, such as web services supplying data to these APIs, and also affects sandboxed Java Web Start applications or applets that load untrusted code relying on the Java sandbox. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact without integrity or availability impact. Oracle's April 2026 Critical Patch Update advisory mentions this vulnerability but does not explicitly state patch availability or remediation details for it. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized access to critical or all accessible data within the affected Oracle Java SE and GraalVM products. The vulnerability impacts confidentiality but does not affect integrity or availability. It allows unauthenticated attackers with network access to compromise data confidentiality via multiple protocols and API usage, including through sandboxed Java applications that load untrusted code.

Oracle has published a Critical Patch Update advisory in April 2026 that addresses multiple vulnerabilities including this one. However, the advisory content provided does not explicitly confirm patch availability or remediation status for CVE-2026-22016. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpuapr2026.html for the latest patch and remediation information and apply all relevant patches promptly. Until official patches are confirmed and applied, caution should be exercised when running untrusted Java code and exposing vulnerable APIs. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.