CVE-2026-114820

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-24 · updated 2026-10-26
Weakness: CWE-327

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Summary

CVE-2026-114820 is a critical (CVSS 9.1) flaw in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. An unauthenticated attacker with network access can exploit it through multiple protocols to gain unauthorized read, create, delete, or modify access to critical data, including in sandboxed deployments that run untrusted code. Affected versions include Oracle Java SE 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, and 27.0.1.0.2; Oracle GraalVM for JDK 17.0.21.0.2 and 21.0.13.0.2; and Oracle GraalVM Enterprise Edition 21.3.20.0.2. It is not in CISA KEV and no exploitation has been reported, with EPSS at 0.3%. Apply the Oracle CPU updates for these products and restrict untrusted code execution where possible.

CVE-2026-114820 ثغرة حرجة (CVSS 9.1) في مكوّن JSSE ضمن Oracle Java SE وOracle GraalVM for JDK وOracle GraalVM Enterprise Edition. يستطيع مهاجم غير مصادَق لديه وصول إلى الشبكة استغلالها عبر بروتوكولات متعددة للحصول على صلاحيات غير مصرّح بها لقراءة البيانات الحساسة أو إنشائها أو حذفها أو تعديلها، بما في ذلك في بيئات التشغيل المعزولة التي تنفّذ تعليمات برمجية غير موثوقة. تشمل الإصدارات المتأثرة Oracle Java SE 8u511-b32 و8u511-perf-b32 و11.0.33.0.2 و17.0.21.0.2 و21.0.13.0.2 و25.0.5.0.2 و27.0.1.0.2، وOracle GraalVM for JDK 17.0.21.0.2 و21.0.13.0.2، وOracle GraalVM Enterprise Edition 21.3.20.0.2. الثغرة غير مدرجة في CISA KEV ولم يُبلَّغ عن استغلالها، واحتمال الاستغلال خلال 30 يوماً وفق EPSS هو 0.3%. يُنصح بتطبيق تحديثات Oracle CPU لهذه المنتجات وتقييد تنفيذ التعليمات البرمجية غير الموثوقة حيثما أمكن.

Affected products

Oracle Corporation Oracle GraalVM for JDK: 17.0.21.0.2, 21.0.13.0.2
Oracle Corporation Oracle GraalVM Enterprise Edition: 21.3.20.0.2
Oracle Corporation Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2 (+1)

References

https://www.oracle.com/security-alerts/alert-cve-2026-114820.html

Get alerted when CVE-2026-114820 or the next vulnerability affects your stack