Oracle Java SE 25.0.4/26.0.2 2D sandbox

Summaryinfo

A vulnerability has been found in Oracle Java SE 25.0.4/26.0.2 and classified as problematic. Affected is an unknown function of the component 2D. This manipulation causes sandbox. This vulnerability is tracked as CVE-2026-70906. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Oracle Java SE 25.0.4/26.0.2 and classified as problematic. Affected by this vulnerability is an unknown part of the component 2D. The manipulation with an unknown input leads to a sandbox vulnerability. The CWE definition for the vulnerability is CWE-265. As an impact it is known to affect availability. The summary by CVE is:

Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 25.0.4 and 26.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

The advisory is shared at oracle.com. This vulnerability is known as CVE-2026-70906 since 08/05/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 10/19/2026). MITRE ATT&CK project uses the attack technique T1611 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 339125 (AlmaLinux 10 : java-25-openjdk (ALSA-2026:55798)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (339125) and CERT Bund (WID-SEC-2026-2897). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• IBM Java
• IBM AIX
• IBM VIOS
• Debian Linux
• IBM WebSphere Service Registry and Repository
• Amazon Linux 2
• IBM Tivoli Business Service Manager
• Open Source OpenJDK
• Red Hat Enterprise Linux
• IBM Tivoli Netcool/OMNIbus
• IBM Tivoli Monitoring
• Azul Zulu
• IBM Rational ClearQuest
• IBM Integration Bus
• IBM WebSphere Application Server
• IBM InfoSphere Information Server
• RESF Rocky Linux
• SUSE Linux
• SUSE openSUSE
• Ubuntu Linux
• Oracle Linux
• IBM WebSphere Application Server Liberty
• Oracle Java SE
• Oracle GraalVM
• Amazon Corretto
• IBM App Connect Enterprise
• IBM Semeru Runtime
• IBM Security Verify Access

Productinfo

Type

• Programming Language Software

Vendor

• Oracle

Name

• Java SE

Version

• 25.0.4
• 26.0.2

License

• open-source

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion