Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N).
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serviceability). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
CVE-2026-91335 is a low-severity vulnerability in Oracle Java SE and Oracle GraalVM products affecting specific versions. It allows a low privileged attacker with network access to cause unauthorized read access to some data, but requires user interaction from a person other than the attacker. This vulnerability mainly affects Java deployments running untrusted code in sandboxed environments such as Java Web Start applications or applets. Server-side Java deployments running only trusted code are not affected. The CVSS 3.1 base score is 2.6, indicating low impact on confidentiality and no impact on integrity or availability.
CVE-2026-91334 is a low-severity vulnerability in Oracle Java SE and Oracle GraalVM products affecting specific versions. It allows an unauthenticated attacker with network access to gain unauthorized read access to certain data via multiple protocols. The vulnerability involves the ImageIO component and can be exploited through APIs, including those used by sandboxed Java Web Start applications or applets that run untrusted code. The CVSS 3.1 base score is 3.7, indicating low impact on confidentiality with no integrity or availability impact. Oracle has released a Critical Patch Update addressing this and many other vulnerabilities.
CVE-2026-91332 is a medium severity vulnerability in Oracle Java SE Networking component affecting specific versions. It allows an unauthenticated attacker with network access to exploit multiple protocols to gain unauthorized insert, update, or delete access to some data accessible by Oracle Java SE. The vulnerability also affects sandboxed Java Web Start applications and applets that run untrusted code relying on the Java sandbox for security. The CVSS 3.1 base score is 5.3, indicating an integrity impact without confidentiality or availability impact. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous patches across Oracle products.
CVE-2026-87294 is a vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition affecting multiple specified versions. It allows an unauthenticated attacker with network access via multiple protocols to gain unauthorized read and write access to some accessible data. The vulnerability can be exploited through APIs, including web services, and affects Java deployments running untrusted code relying on the Java sandbox. The CVSS 3.1 base score is 6.5, indicating a medium severity impact on confidentiality and integrity.
CVE-2026-87293 is a vulnerability in Oracle Java SE's RMI component affecting versions 8u503 and 8u503-perf, as well as Oracle GraalVM Enterprise Edition 21.3.19.1.1. It allows an unauthenticated attacker with network access to supply data to certain APIs, potentially leading to unauthorized read and write access to some accessible data. The vulnerability is difficult to exploit and does not require user interaction. The CVSS 3.1 base score is 5.4, indicating medium severity with confidentiality and integrity impacts but no availability impact. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous patches across many products.
CVE-2026-87292 is a low-severity vulnerability in Oracle Java SE and Oracle GraalVM products affecting multiple specified versions. It allows an unauthenticated attacker with network access to potentially perform unauthorized update, insert, or delete operations on accessible data via multiple protocols. The vulnerability involves the Networking component and can be exploited through APIs, including web services supplying data to these APIs. It also affects sandboxed Java Web Start applications or applets that run untrusted code relying on the Java sandbox for security. The CVSS 3.1 base score is 3.7, indicating low impact primarily on integrity without confidentiality or availability impact. Oracle has released a Critical Patch Update containing many security patches, including for this vulnerability, and strongly recommends applying patches promptly.
CVE-2026-87291 is a vulnerability in Oracle Java SE Networking component affecting versions 21.0.12.1, 25.0.4.1, and 27. It allows an unauthenticated attacker with network access to supply data to certain APIs and gain unauthorized read access to some accessible data. The vulnerability does not require user interaction or privileges and has a CVSS 3.1 base score of 5.3, indicating a medium severity confidentiality impact. Exploitation does not involve untrusted Java Web Start applications or applets but can occur through web services or other network protocols.
CVE-2026-87290 is a vulnerability in Oracle Java SE and Oracle GraalVM products affecting specific versions. It allows an unauthenticated attacker with network access to potentially gain unauthorized access to critical data by exploiting APIs in the JAXP component. The vulnerability impacts confidentiality but does not affect integrity or availability. It is difficult to exploit and can be triggered via multiple protocols, including through sandboxed Java Web Start applications or applets that run untrusted code. The CVSS 3.1 base score is 5.9, indicating a medium severity level. Oracle has released a Critical Patch Update addressing this and many other vulnerabilities, and customers are strongly advised to apply patches promptly.
CVE-2026-83400 is a vulnerability in Oracle Java SE and Oracle GraalVM products affecting specific versions. It allows an unauthenticated attacker with network access to cause a partial denial of service (DoS) via multiple protocols by exploiting APIs in the JAXP component. The vulnerability impacts availability but does not affect confidentiality or integrity. It also applies to sandboxed Java Web Start applications or applets that load untrusted code relying on the Java sandbox. The CVSS 3.1 base score is 5.3, indicating medium severity.
CVE-2026-83395 is a vulnerability in Oracle Java SE and Oracle GraalVM products affecting multiple specified versions. It allows an unauthenticated attacker with network access to exploit APIs in the networking component, potentially leading to unauthorized modification of accessible data and partial denial of service. The vulnerability impacts integrity and availability but does not affect confidentiality. It can be exploited via multiple protocols and applies also to sandboxed Java Web Start applications or applets that run untrusted code relying on the Java sandbox. The CVSS 3.1 base score is 6.5, indicating a medium severity level.
CVE-2026-83387 is a vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition affecting the JDBC component. It allows an unauthenticated attacker with network access to potentially gain unauthorized access to critical data. The vulnerability is difficult to exploit and impacts confidentiality without affecting integrity or availability. It can be exploited via multiple protocols and through APIs, including scenarios involving sandboxed Java Web Start applications or applets running untrusted code. The CVSS 3.1 base score is 5.9, indicating medium severity.
CVE-2026-83381 is a vulnerability in Oracle Java SE's Security component affecting multiple supported versions. It allows an unauthenticated attacker with network access to exploit the flaw via multiple protocols. Successful exploitation can lead to unauthorized read and modification (update, insert, delete) of some accessible data within Oracle Java SE. The vulnerability is difficult to exploit and impacts confidentiality and integrity but not availability. It also affects Java deployments running sandboxed Java Web Start applications or applets that load untrusted code relying on the Java sandbox. The CVSS 3.1 base score is 4.8, indicating medium severity.
CVE-2026-83380 is a vulnerability in Oracle Java SE and Oracle GraalVM products affecting multiple specified versions. It allows an unauthenticated attacker with network access to exploit APIs in the JAAS component, potentially gaining unauthorized read access to some accessible data. The vulnerability impacts confidentiality but does not affect integrity or availability. It can be exploited via multiple protocols and applies to Java deployments running sandboxed Java Web Start applications or applets that load untrusted code. The CVSS 3.1 base score is 5.3, indicating medium severity.
CVE-2026-101737 is a vulnerability in Oracle Java SE version 26.0.2 affecting the Compiler component. It allows an unauthenticated attacker with network access to cause a denial of service (hang or frequent crash) by supplying data to certain APIs. Exploitation does not require untrusted Java Web Start applications or applets. The vulnerability has a CVSS 3.1 base score of 5.9, indicating medium severity with impact limited to availability.
CVE-2026-101516 is a vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition libraries. It allows an unauthenticated attacker with network access via multiple protocols to gain unauthorized read and write access to certain accessible data. The vulnerability affects specific versions of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition. Exploitation can occur through APIs, including web services supplying data to these APIs, and also affects sandboxed Java Web Start applications or applets that run untrusted code relying on the Java sandbox for security. The CVSS 3.1 base score is 6.5, indicating a medium severity vulnerability. Oracle has released patches as part of their October 2026 Critical Patch Update and strongly recommends applying them promptly.
CVE-2026-70906 is a high-severity vulnerability in Oracle Java SE 25.0.4 and 26.0.2 affecting the 2D component. It allows an unauthenticated attacker with network access via multiple protocols to cause a denial of service by hanging or crashing the Java SE environment. The vulnerability can be exploited through APIs, including via sandboxed Java Web Start applications or applets running untrusted code. The CVSS 3.1 base score is 7.5, reflecting significant availability impact without confidentiality or integrity loss.
Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).