This advisory addresses multiple vulnerabilities in Red Hat Hardened Images RPMs, particularly in the java-25-openjdk-portable packages for aarch64 and x86_64 architectures. The key vulnerability, CVE-2026-22007, affects Oracle Java SE and related Oracle GraalVM products due to the use of broken or risky cryptographic algorithms (CWE-327). This vulnerability allows an unauthenticated attacker with local access to potentially gain unauthorized read access to certain data. The vulnerabilities also relate to other weaknesses such as improper input validation and resource management (CWE-319, CWE-611, CWE-125, CWE-674, CWE-835). The advisory lists the updated RPM versions but does not specify fixed affected versions or explicit patch details. Red Hat provides guidance to apply the update available via their hardened images repository.

Successful exploitation of CVE-2026-22007 can lead to unauthorized read access to sensitive data due to weak cryptographic protections. The vulnerabilities collectively may compromise confidentiality and potentially affect integrity and accountability in certain scenarios. The attack complexity is high, requiring local access without privileges or user interaction. There are no known exploits in the wild at this time. The overall impact is rated high by Red Hat.

Red Hat has released updated RPM packages for java-25-openjdk-portable as part of the hardened images update. Users should apply these updates to remediate the vulnerabilities. Since this is an official Red Hat security advisory with updated packages available, applying the vendor-provided updates is the recommended mitigation. No additional mitigations or workarounds are specified in the advisory. Patch status is confirmed by the availability of updated RPMs in the hardened images repository.