CVE-2026-83395 in Java SE
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Networking component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products. This security flaw affects a broad range of supported versions including Oracle Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, and 25.0.4.1, as well as specific releases of Oracle GraalVM for JDK versions 17.0.20.1 and 21.0.12.1, and Oracle GraalVM Enterprise Edition version 21.3.19.1.1. The core issue stems from a flaw in how the networking subsystem processes incoming data or handles network connections, allowing for unauthorized manipulation of internal state or resources when interacting with external inputs via multiple protocols such as HTTP, HTTPS, RMI, or other Java-supported communication channels.
This vulnerability is characterized by its high exploitability and lack of required authentication prerequisites. An unauthenticated attacker possessing network access to the affected system can leverage this flaw to compromise the integrity and availability of the target environment. The attack vector does not require user interaction, meaning that automated tools can probe for and exploit this weakness without any social engineering or client-side triggers like clicking a link or opening a file. This makes it particularly dangerous in server environments where Java applications are exposed directly to network traffic, as well as in client-side deployments involving sandboxed Java Web Start applications or applets that load untrusted code from the internet and rely on the Java security manager for protection.
The operational impact of successful exploitation is significant, primarily affecting data integrity and system availability. Attackers can perform unauthorized updates, inserts, or deletes against accessible data managed by the vulnerable application logic. This capability allows an adversary to corrupt databases, alter configuration files, or inject malicious payloads into persistent storage if such operations are permitted through the exposed APIs. Furthermore, the vulnerability enables a partial denial of service condition. By triggering resource exhaustion conditions within the networking stack, attackers can degrade performance or cause specific services hosted on the Java platform to become unresponsive, thereby disrupting business continuity and user access without necessarily crashing the entire JVM process immediately.
From a classification perspective, this flaw aligns with CWE-20 Improper Input Validation, as the root cause likely involves insufficient sanitization or validation of network input data before it is processed by critical networking APIs. The ability to modify accessible data maps directly to CWE-798 Use of Hard-coded Credentials if authentication bypasses are involved, but more accurately reflects CWE-352 Cross-Site Request Forgery or CWE-601 URL Redirection to Untrusted Site in contexts involving web services, though the primary classification remains input validation failure leading to state modification. In terms of offensive security frameworks, this vulnerability supports techniques associated with MITRE ATT&CK T1190 Exploit Public-Facing Application and potentially T1498 Network Denial of Service if the partial DOS aspect is fully realized through resource exhaustion attacks against network threads or connection pools.
Mitigation strategies must prioritize immediate patching to the latest available versions listed in Oracle Critical Patch Update advisories, as these releases contain specific fixes for the networking component flaws. For environments where immediate patching is not feasible due to compatibility constraints, organizations should implement strict network segmentation and firewall rules to restrict access to Java-based services from untrusted networks. Additionally, deploying Web Application Firewalls with deep packet inspection capabilities can help detect and block malformed requests that attempt to exploit this input validation weakness. It is also crucial to review the security manager configurations for any sandboxed deployments, ensuring that permissions are granted on a least-privilege basis to limit the potential impact of an exploited vulnerability within the Java runtime environment.