Oracle Java SE 25.0.4/26.0.2 2D sandbox

Summaryinfo

A vulnerability has been found in Oracle Java SE 25.0.4/26.0.2 and classified as problematic. Affected is an unknown function of the component 2D. This manipulation causes sandbox. This vulnerability is tracked as CVE-2026-70906. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability has been found in Oracle Java SE 25.0.4/26.0.2 and classified as problematic. Affected by this vulnerability is an unknown part of the component 2D. The manipulation with an unknown input leads to a sandbox vulnerability. The CWE definition for the vulnerability is CWE-265. As an impact it is known to affect availability. The summary by CVE is:

Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 25.0.4 and 26.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

The advisory is shared at oracle.com. This vulnerability is known as CVE-2026-70906 since 08/05/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $25k-$100k at the moment (estimation calculated on 08/20/2026). MITRE ATT&CK project uses the attack technique T1611 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-2897). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Open Source OpenJDK
• Red Hat Enterprise Linux
• Azul Zulu
• RESF Rocky Linux
• Oracle Java SE
• Oracle GraalVM
• Amazon Corretto

Productinfo

Type

• Programming Language Software

Vendor

• Oracle

Name

• Java SE

Version

• 25.0.4
• 26.0.2

License

• open-source

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion