This advisory covers a security update for IBM Java SE version 8, which includes the IBM Java Runtime Environment and Software Development Kit. It addresses 14 CVEs affecting components such as Little CMS, OpenJDK, Eclipse OpenJ9, Eclipse OMR, and the java-1.8.0-ibm package itself. Notable issues include arbitrary class loading and instantiation via a malicious IIOP server (CVE-2026-8400), buffer underflow in Eclipse OpenJ9 (CVE-2026-16439), denial of service via improper input validation in Eclipse OMR (CVE-2026-16243), and multiple enhancements to TLS certificate handling, image processing, Jar file handling, and certification checking. The update is provided by Red Hat for Red Hat Enterprise Linux 8 across x86_64, IBM z Systems, and Power little endian architectures.

The vulnerabilities collectively could lead to information disclosure, denial of service, integrity issues, and arbitrary code loading or instantiation. Specifically, CVE-2026-8400 allows arbitrary class loading and instantiation via a malicious IIOP server, which could lead to execution of untrusted code. Other vulnerabilities may cause denial of service or information leaks. The overall security impact is rated as important by Red Hat, indicating significant risk if unpatched.

Red Hat has released updated packages for java-1.8.0-ibm for Red Hat Enterprise Linux 8 on supported architectures. Users should apply the update as described in the Red Hat advisory RHSA-2026:52949 available at https://access.redhat.com/articles/11258. This update includes fixes for all listed CVEs. No additional mitigations are specified beyond applying the official update.