Search: CVE-2026-22018

CVE-2026-22018 is a low-severity vulnerability affecting multiple versions of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. It allows an unauthenticated attacker with network access via multiple protocols to cause a partial denial of service (partial DOS) by exploiting APIs in the affected component. The vulnerability is difficult to exploit and does not impact confidentiality or integrity. It applies to Java deployments that run untrusted code relying on the Java sandbox. No known exploits are reported in the wild. Oracle has not explicitly stated patch availability for this specific vulnerability in the advisory but recommends applying the April 2026 Critical Patch Update, which includes numerous security patches. The CVSS 3.1 base score is 3.7, indicating a low impact primarily on availability.