What happened
A vulnerability identified as CVE-2026-114820 has been disclosed affecting several Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products. The vulnerability resides within the JSSE component and can be exploited remotely over a network, with no prerequisite for prior access or user interaction. The flaw allows unauthenticated attackers to execute code remotely, leading to a high impact on confidentiality and integrity of the affected systems. The vulnerability can be exploited via exposed services that handle network protocols, where attackers might use APIs or web services that supply data to attack vectors. The flaw is applicable to Java deployments that run sandboxed Java Web Start applications or applets loading untrusted code from unverified sources, relying on the Java sandbox for security. Successful exploitation results in the attacker gaining unauthorized access that can modify or delete critical data, potentially compromising entire systems through remote code execution. The affected versions include Oracle Java SE versions 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2; Oracle GraalVM for JDK versions 17.0.21.0.2 and 21.0.13.0.2; and Oracle GraalVM Enterprise Edition version 21.3.20.0.2. The vulnerability is rated as critical due to its high CVSS score of 9.1, with an exploit vector that requires no user interaction or privileges to carry out. No specific patches are available at this time for remediation. Who is affected Organisations running affected versions of Oracle Java SE, Oracle GraalVM for JDK, or Oracle GraalVM Enterprise Edition are vulnerable to this flaw. Systems that expose relevant services over a network are at risk of remote exploitation, especially those allowing untrusted code execution or loading untrusted Java components. The vulnerability impacts environments where unpatched Java components are accessible via network protocols without sufficient access controls or network segmentation. Recommended actions
Restrict network access to Java services and components, especially those exposed over the internet. Ensure that only trusted networks can reach the vulnerable endpoints. Implement strict access controls and network segmentation to limit exposure of affected services to untrusted sources. Monitor network traffic for suspicious activity targeting Java applications, APIs, or web services that could be exploited by an unauthenticated attacker.
