CVE-2026-83380 in Java SE
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAAS). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Java Authentication and Authorization Service, commonly referred to as JAAS, a core component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. This security flaw affects multiple supported versions including Oracle Java SE releases 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, and 25.0.4.1, as well as Oracle GraalVM for JDK versions 17.0.20.1 and 21.0.12.1, and Oracle GraalVM Enterprise Edition version 21.3.19.1.1. The JAAS framework is responsible for authenticating users and enforcing access controls within Java applications, making its integrity critical to the overall security posture of any system relying on it for identity management and authorization decisions.
The technical nature of this vulnerability allows an unauthenticated attacker with network access via multiple protocols to compromise these specific Oracle products. The exploitability stems from flaws in how JAAS handles authentication requests or processes data supplied through APIs, such as those exposed by web services. When a Java application loads and runs untrusted code, particularly in client-side deployments like sandboxed Java Web Start applications or sandboxed Java applets that fetch resources from the internet, it relies heavily on the Java security manager to enforce boundaries. This vulnerability undermines those safeguards by allowing unauthorized read access to a subset of data accessible within the Oracle environment. The attacker does not require prior authentication, which significantly lowers the barrier for exploitation and increases the risk profile associated with network-facing services that utilize these vulnerable components.
The operational impact is primarily centered on confidentiality breaches rather than integrity or availability disruptions. Successful exploitation results in unauthorized read access to sensitive information stored or processed by the affected Java applications. This could include user credentials, session tokens, configuration data, or other proprietary information depending on how JAAS is integrated into the specific application architecture. The CVSS 3.1 base score of 5.3 reflects a medium severity level driven largely by confidentiality impacts. The vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates that the attack is network-based, requires low complexity, needs no user interaction or privileges, and affects only confidentiality without impacting integrity or availability in this specific instance.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, as it involves unauthorized access to resources due to flawed authentication logic within JAAS. It also maps to MITRE ATT&CK techniques related to Initial Access and Credential Access, specifically where attackers leverage API endpoints or web services to gain footholds in systems running vulnerable Java versions. The ability to exploit this through APIs highlights the importance of securing not just front-end interfaces but also backend service interactions that feed data into JAAS modules.
Mitigation strategies must focus on immediate patching and architectural review. Organizations should update all affected Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition installations to their latest available versions as soon as possible. For environments where upgrading is not immediately feasible, network segmentation can help limit exposure by restricting access to the vulnerable components from untrusted networks. Additionally, implementing strict input validation on web services that supply data to JAAS APIs can reduce the attack surface. Security teams should also audit Java deployments for any usage of sandboxed applets or Web Start applications loading untrusted code, as these are particularly susceptible to exploitation given their reliance on the compromised security boundaries. Regular vulnerability scanning and monitoring for anomalous authentication attempts can further aid in detecting potential exploitation activities before significant data loss occurs.