CVE-2026-114820 in GraalVM Enterprise Edition
Summary
by MITRE • 10/24/2026
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/24/2026
The identified vulnerability resides within the Java Secure Socket Extension, commonly referred to as JSSE, which is a core component of Oracle Java SE and its associated distributions including Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition. This security flaw affects multiple supported versions spanning from older releases like 8u511-b32 up through recent long-term support and early access builds such as 17.0.21.0.2, 21.0.13.0.2, and newer iterations in the 25 and 27 series. The JSSE library is responsible for implementing secure network communication protocols including TLS and SSL, handling encryption, decryption, certificate validation, and handshake procedures. A critical flaw within this component allows an unauthenticated attacker to exploit weaknesses through multiple network-accessible protocols, indicating that the vulnerability does not require prior authentication or user interaction to be triggered remotely over a network connection.
The technical nature of this vulnerability enables unauthorized creation, deletion, or modification of data considered critical by the application using Java SE components. Furthermore, it grants attackers the ability to gain complete access to all data accessible by the compromised Oracle Java environment. This level of impact suggests that the flaw likely involves improper validation of input data during cryptographic operations or protocol handshakes, potentially leading to memory corruption, logic bypasses in security checks, or injection attacks within the secure channel establishment process. The vulnerability can be exploited via APIs exposed through web services that supply data directly to these JSSE components, highlighting a risk for server-side applications as well as client-side deployments where untrusted code is loaded and executed under Java sandbox restrictions.
From an operational perspective, this high-severity issue poses significant risks to confidentiality and integrity of systems relying on affected versions. The CVSS 3.1 base score of 9.1 reflects the ease of exploitation due to low attack complexity and no required privileges or user interaction. Attackers with network access can leverage this flaw to exfiltrate sensitive information, alter critical datasets without authorization, or potentially establish persistent backdoors by manipulating secure connections. For organizations running Java Web Start applications or sandboxed applets that fetch resources from the internet, the reliance on the Java sandbox for security is undermined if the underlying JSSE implementation fails to properly isolate untrusted code behavior during network communications.
This vulnerability aligns with CWE-20 Improper Input Validation and potentially CWE-787 Out-of-bounds Write depending on the specific memory corruption mechanism involved in the exploit chain. In terms of adversary tactics, it corresponds to MITRE ATT&CK techniques related to Initial Access via Network Service Exploitation and Defense Evasion through manipulation of secure channels. To mitigate this risk, immediate patching is required by upgrading Oracle Java SE, GraalVM for JDK, or GraalVM Enterprise Edition to the latest available versions that include fixes for this specific JSSE flaw. Organizations should also implement network segmentation to limit exposure of vulnerable services and monitor for anomalous traffic patterns indicative of exploitation attempts against TLS/SSL endpoints using affected software stacks.