CVE-2026-114820: Critical Vulnerability in Oracle Java SE and GraalVM

CVE-2026-114820 CVSS 9.1: unauthenticated data access in Oracle Java and GraalVM. Patch available.

CVE-2026-114820 is a vulnerability in the JSSE component of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition. The flaw allows an unauthenticated attacker with network access to unauthorized modify and access critical data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low attack effort: no authentication, no user interaction required. Impact on data confidentiality and integrity, with potential sandbox escape for Java applets or Web Start applications.

With CVSS 9.1, CVE-2026-114820 is classified as critical. The vulnerability was published on NVD on October 24, 2026. Consistent with its criticality, a GitHub-hosted offline inventory tool was released today (October 30) to identify vulnerable Java and GraalVM builds: a signal that the issue is relevant and attackers may begin reconnaissance of targets.

Defensive actions must be immediate: 1) Inventory Java SE and GraalVM instances in use. 2) Verify versions: Java SE 8u511-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; GraalVM for JDK 17.0.21.0.2, 21.0.13.0.2; GraalVM Enterprise 21.3.20.0.2. 3) Monitor Oracle's Critical Patch Updates and apply patches promptly. 4) Monitor for anomalies on JSSE services. 5) Reexamine sandboxing and trust policies for applets.

At a glance

What: Vulnerability in the JSSE (Java Secure Socket Extension) component of Oracle Java SE (versions 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2), Oracle GraalVM for JDK (17.0.21.0.2, 21.0.13.0.2) and Oracle GraalVM Enterprise Edition (21.3.20.0.2). Permits unauthenticated network access to unauthorized modification and access of critical data.
Severity: CVSS 3.1 9.1 (Confidentiality: High, Integrity: High, Availability: None). Easily exploitable network attack, no authentication required, no user interaction needed.
Affected versions: Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2, 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2.
Fix: Patches available in Oracle's Critical Patch Updates. For updates and details, consult Oracle's official security bulletins. Specific patch numbers or build versions not available in verified data.
Status: Published on NVD on October 24, 2026. Public detection tool reported on GitHub (October 30, 2026) to identify affected Java and GraalVM builds.
Action: 1) Inventory all instances of Oracle Java SE, GraalVM JDK, and GraalVM Enterprise Edition in use. 2) Verify versions against the published list. 3) Monitor Oracle's Critical Patch Updates and apply patches without delay. 4) Monitor applications and services using JSSE for anomalies. 5) In environments with Java applets or Web Start applications, reexamine sandboxing and trust policies.

Sources: NVD, CVE-2026-114820

← All articles