Search: CVE-2026-22013

CVE-2026-22013 is a medium severity vulnerability affecting multiple versions of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. It involves a difficult-to-exploit flaw that allows an unauthenticated attacker with network access via multiple protocols to potentially gain unauthorized access to critical or all accessible data. Exploitation requires human interaction from a user other than the attacker. This vulnerability primarily impacts Java deployments running untrusted code in sandboxed environments such as Java Web Start applications or applets, and does not affect server deployments running only trusted code. The CVSS 3.1 base score is 5.3, reflecting a confidentiality impact without integrity or availability impact. Oracle has not explicitly stated a patch or fix for this specific vulnerability in the provided advisory, but recommends applying Critical Patch Updates promptly to mitigate risks.