Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition RMI improper authentication

Summaryinfo

A vulnerability categorized as critical has been discovered in Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition. This affects an unknown function of the component RMI. The manipulation results in improper authentication. This vulnerability is reported as CVE-2026-21925. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition (affected version unknown). It has been classified as critical. Affected is an unknown functionality of the component RMI. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

The advisory is available at oracle.com. This vulnerability is traded as CVE-2026-21925 since 01/05/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 06/10/2026).

The vulnerability scanner Nessus provides a plugin with the ID 294885 (Amazon Corretto Java 8.x < 8.482.08.1 Multiple Vulnerabilities), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (294885), EUVD (EUVD-2026-3584) and CERT Bund (WID-SEC-2026-0164). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• IBM Java SDK
• Debian Linux
• IBM Tivoli Monitoring
• Amazon Linux 2
• IBM Power Hardware Management Console
• Open Source OpenJDK
• Red Hat Enterprise Linux
• Ubuntu Linux
• IBM WebSphere Application Server
• SUSE Linux
• IBM Tivoli Netcool/OMNIbus
• Oracle Linux
• IBM Tivoli Business Service Manager
• IBM TXSeries
• IBM License Metric Tool
• Hitachi Ops Center
• Hitachi Configuration Manager
• IBM MQ
• Dell Data Protection Advisor
• IBM Rational Business Developer
• SUSE openSUSE
• RESF Rocky Linux
• IBM App Connect Enterprise
• IBM InfoSphere Information Server
• Azul Zulu
• Hitachi Command Suite
• IBM Sterling Connect:Direct
• IBM WebSphere Service Registry and Repository
• Oracle Java SE
• Oracle GraalVM
• Amazon Corretto
• Tenable Security Nessus Network Monitor
• IBM Integration Bus
• Dell NetWorker
• Dell Secure Connect Gateway
• IBM DataPower Gateway
• IBM Semeru Runtime
• Dell ECS

Productinfo

Type

• Programming Language Software

Vendor

• Oracle

Name

• GraalVM Enterprise Edition
• GraalVM for JDK
• Java SE

License

• open-source

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion