Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition Security improper authorization

Summaryinfo

A vulnerability identified as critical has been detected in Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition. Affected by this vulnerability is an unknown functionality of the component Security. This manipulation causes improper authorization. This vulnerability appears as CVE-2026-22007. The attack requires local access. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition (affected version not known). Affected by this vulnerability is some unknown functionality of the component Security. The manipulation with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality. The summary by CVE is:

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 2.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

The advisory is shared at oracle.com. This vulnerability is known as CVE-2026-22007 since 01/05/2026. The exploitation appears to be difficult. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 309659 (RHEL 7 / 8 / 9 : Java 11 OpenJDK ELS Security Update (Important) (RHSA-2026:9254)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (309659) and CERT Bund (WID-SEC-2026-1201). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Debian Linux
• IBM Tivoli Monitoring
• Amazon Linux 2
• Open Source OpenJDK
• Red Hat Enterprise Linux
• Ubuntu Linux
• IBM WebSphere Application Server
• SUSE Linux
• IBM Tivoli Netcool/OMNIbus
• Oracle Linux
• IBM Rational Software Architect
• IBM TXSeries
• IBM InfoSphere Information Server
• IBM Content Manager
• SUSE openSUSE
• RESF Rocky Linux
• NetApp ActiveIQ Unified Manager
• Azul Zulu
• IBM Semeru Runtime
• Open Source Camunda
• IBM App Connect Enterprise
• Oracle Java SE
• Oracle GraalVM
• IBM Java
• IBM Business Automation Workflow
• RealObjects PDFreactor
• IBM Rational Application Developer for WebSphere Software
• IBM WebSphere Service Registry and Repository
• IBM Tivoli Network Manager

Productinfo

Type

• Programming Language Software

Vendor

• Oracle

Name

• GraalVM Enterprise Edition
• GraalVM for JDK
• Java SE

License

• open-source

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion