This vulnerability (CVE-2026-22018) exists in the Libraries component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition across multiple supported versions. It allows an unauthenticated attacker with network access to cause a partial denial of service by exploiting APIs, including those used by sandboxed Java Web Start applications or applets that load untrusted code. The attack vector is network-based with high attack complexity and no privileges or user interaction required. The vulnerability affects availability only, with no impact on confidentiality or integrity. The CVSS vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L. Oracle’s April 2026 Critical Patch Update advisory references many patches but does not explicitly confirm a patch for this CVE. No known exploits have been reported.

Successful exploitation can lead to a partial denial of service condition in Oracle Java SE and related products, potentially disrupting availability of affected Java applications or services. There is no impact on confidentiality or integrity. The vulnerability is difficult to exploit and requires network access with high attack complexity. No known exploits in the wild have been reported.

Oracle’s April 2026 Critical Patch Update advisory strongly recommends applying the latest cumulative security patches promptly. Although the advisory does not explicitly confirm a patch for CVE-2026-22018, applying the April 2026 CPU is advised to address this and other vulnerabilities. Customers should remain on actively supported versions and apply Critical Patch Updates without delay. Patch status for this specific vulnerability is not explicitly confirmed; therefore, check the vendor advisory for the latest remediation guidance.