This vulnerability (CVE-2026-22021) affects the JSSE component of Oracle Java SE and Oracle GraalVM products across multiple versions. It allows an unauthenticated attacker with network access over HTTPS to cause a partial denial of service. The attack vector requires no privileges or user interaction and impacts availability only. The vulnerability can be exploited via APIs, including those used by sandboxed Java Web Start applications or applets that load untrusted code. The CVSS 3.1 score is 5.3 (medium severity). Oracle's April 2026 Critical Patch Update advisory references numerous security patches but does not explicitly state the patch status for this vulnerability. No known exploits in the wild have been reported.

Successful exploitation results in a partial denial of service impacting availability of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. There is no impact on confidentiality or integrity. The vulnerability can be triggered remotely without authentication via HTTPS network access. It affects multiple supported versions of the products listed. No known active exploitation has been reported.

Oracle strongly recommends applying the April 2026 Critical Patch Update and staying current with all security patches. Although the vendor advisory does not explicitly confirm a patch specifically for CVE-2026-22021, the advisory covers a broad set of vulnerabilities and customers should apply the update promptly. Patch status is not yet confirmed specifically for this CVE—check the Oracle advisory at https://www.oracle.com/security-alerts/cpuapr2026.html for the latest remediation guidance. No vendor advisory states that no action is required or that the issue is already mitigated.