This vulnerability (CVE-2026-46968) affects the JSSE component of Oracle Java SE and certain Oracle GraalVM versions. It permits an unauthenticated attacker with network access via TLS to compromise the integrity of data by unauthorized creation, deletion, or modification. The attack vector requires supplying data to APIs in the JSSE component, excluding untrusted Java Web Start applications or applets. The CVSS 3.1 vector indicates network attack vector with high attack complexity and no privileges or user interaction required. The impact is limited to integrity with no confidentiality or availability impact. The vulnerability affects Oracle Java SE versions 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, and 26.0.1, as well as Oracle GraalVM for JDK 17.0.19 and 21.0.11, and Oracle GraalVM Enterprise Edition 21.3.18. Oracle’s July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation details for these versions in the provided excerpt.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible by Oracle Java SE, impacting data integrity. There is no impact on confidentiality or availability. The vulnerability is difficult to exploit and requires network access via TLS. No known exploits in the wild have been reported.

Oracle’s July 2026 Critical Patch Update advisory references this vulnerability as part of a large set of security patches. However, the provided advisory content does not explicitly confirm patch availability or remediation status for the affected Oracle Java SE versions. Users should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch and remediation information. Until a patch is confirmed, cautious handling of network inputs to the JSSE component and limiting exposure to untrusted network sources may reduce risk.