Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition Remote Code Execution

Summaryinfo

A vulnerability marked as critical has been reported in Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in Remote Code Execution. This vulnerability is known as CVE-2026-21933. Remote exploitation of the attack is possible. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition (the affected version is unknown). This affects an unknown code. The manipulation with an unknown input leads to a remote code execution vulnerability. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

The advisory is shared at oracle.com. This vulnerability is uniquely identified as CVE-2026-21933 since 01/05/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/11/2026).

The vulnerability scanner Nessus provides a plugin with the ID 294885 (Amazon Corretto Java 8.x < 8.482.08.1 Multiple Vulnerabilities), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (294885), EUVD (EUVD-2026-3576) and CERT Bund (WID-SEC-2026-0164). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• IBM Java SDK
• Debian Linux
• IBM Tivoli Monitoring
• Amazon Linux 2
• IBM Power Hardware Management Console
• Open Source OpenJDK
• Red Hat Enterprise Linux
• Ubuntu Linux
• IBM WebSphere Application Server
• SUSE Linux
• IBM Tivoli Netcool/OMNIbus
• Oracle Linux
• IBM Tivoli Business Service Manager
• IBM TXSeries
• IBM License Metric Tool
• Hitachi Ops Center
• Hitachi Configuration Manager
• IBM MQ
• Dell Data Protection Advisor
• IBM Rational Business Developer
• SUSE openSUSE
• RESF Rocky Linux
• IBM App Connect Enterprise
• IBM InfoSphere Information Server
• Azul Zulu
• Hitachi Command Suite
• IBM Sterling Connect:Direct
• IBM WebSphere Service Registry and Repository
• Oracle Java SE
• Oracle GraalVM
• Amazon Corretto
• Tenable Security Nessus Network Monitor
• IBM Integration Bus
• Dell NetWorker
• Dell Secure Connect Gateway
• IBM DataPower Gateway
• IBM Semeru Runtime
• Dell ECS

Productinfo

Type

• Programming Language Software

Vendor

• Oracle

Name

• GraalVM Enterprise Edition
• GraalVM for JDK
• Java SE

License

• open-source

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion