Vulnerability-Lookup

RHSA-2026:88352

Vulnerability from csaf_redhat - Published: 2026-10-27 16:37 - Updated: 2026-10-29 14:18

Summary

Red Hat Security Advisory: java-17-openjdk security update for RHEL 8

Severity

Important

Notes

Topic: An update for java-17-openjdk is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Extended Update Support, and Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Enhance PKCS5 padding (CVE-2026-83374) * JDK: Enhance TLS certificate handling (CVE-2026-83376) * JDK: Enhance LDAP logins (CVE-2026-83380) * JDK: Enhance SASL Authentication (CVE-2026-83381) * JDK: Enhance WebRowSets (CVE-2026-83387) * JDK: Enhance HTTP Client Response Handling (CVE-2026-83395) * JDK: Enhance XML Processing (CVE-2026-83400) * JDK: Enhance XPath Expressions (CVE-2026-87290) * JDK: Enhance Network Clients (CVE-2026-87292) * JDK: Enhance Certificate Name Checks (CVE-2026-87294) * JDK: Enhance Template Handling (CVE-2026-87367) * JDK: Enhance HTTP Client (CVE-2026-91332) * JDK: Enhance JPEG loading (CVE-2026-91334) * JDK: Enhance Image Handling (CVE-2026-91335) * JDK: Enhance TLS handshakes (CVE-2026-91373) * JDK: Enhance jstatd (CVE-2026-91374) * JDK: Enhance jmod handling (CVE-2026-91375) * JDK: Enhance JShell (CVE-2026-91379) * JDK: Enhance Preferences (CVE-2026-91380) * JDK: Enhance Image Processing (CVE-2026-91382) * JDK: Enhance HTTP client caching (CVE-2026-91394) * JDK: Enhance diagnostic sessions (CVE-2026-91397) * JDK: Enhance SOCKS5 support (CVE-2026-91398) * JDK: Enhance MIDI file handling (CVE-2026-91400) * JDK: Enhance zipfs (CVE-2026-91410) * JDK: Enhance font rendering (CVE-2026-91415) * JDK: Enhance GIF loading (CVE-2026-91418) * JDK: Enhance HTTP server parsing (CVE-2026-91451) * JDK: Enhance HTTP server (CVE-2026-91452) * JDK: Improve HTTP headers (CVE-2026-91453) * JDK: Enhance TLS Extensions (CVE-2026-91461) * JDK: Enhance krb5 tokens (CVE-2026-91462) * JDK: Enhance krb5 client (CVE-2026-91463) * JDK: Enhance Kerberos validation (CVE-2026-91464) * JDK: Enhance C2 comparisons (CVE-2026-91487) * JDK: Enhance Certificate Constraint Checking (CVE-2026-101516) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Note that the OpenJDK RPMs use the system certificate store, so the eMudhra CVEs (CVE-2026-91403 & CVE-2026-114820) should be resolved by updating the ca-certificates package.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-83374

A flaw was found in OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by sending crafted requests across network protocols to exposed application programming interfaces (APIs) within the Security component. A successful attack can result in unauthorized modification, creation, or deletion of critical application data. In addition, the flaw may allow untrusted code running in a restricted sandbox environment to tamper with protected data.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-358 - Improperly Implemented Security Check for Standard

Affected products

Fixed 280 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-1:17.0.21.0.9-2.1.el8.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-debuginfo-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-debuginfo-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-debuginfo-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-debugsource-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-debugsource-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-debugsource-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-debugsource-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-demo-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-demo-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-demo-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-demo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-debuginfo-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-debuginfo-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-debuginfo-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-debuginfo-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-debuginfo-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-debuginfo-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-javadoc-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-javadoc-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-javadoc-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-javadoc-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-javadoc-zip-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-javadoc-zip-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-javadoc-zip-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-javadoc-zip-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-jmods-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-jmods-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-jmods-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-jmods-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-src-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-src-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-src-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-src-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-static-libs-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-static-libs-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-static-libs-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:java-17-openjdk-static-libs-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:java-17-openjdk-1:17.0.21.0.9-2.1.el8.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:java-17-openjdk-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:java-17-openjdk-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:java-17-openjdk-debugsource-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:java-17-openjdk-demo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:java-17-openjdk-devel-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:java-17-openjdk-devel-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:java-17-openjdk-devel-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:java-17-openjdk-devel-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:java-17-openjdk-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:java-17-openjdk-headless-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:java-17-openjdk-headless-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:java-17-openjdk-headless-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:java-17-openjdk-headless-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:java-17-openjdk-javadoc-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:java-17-openjdk-javadoc-zip-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:java-17-openjdk-jmods-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:java-17-openjdk-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:java-17-openjdk-src-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:java-17-openjdk-static-libs-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-1:17.0.21.0.9-2.1.el8.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-debugsource-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-demo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-demo-fastdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-demo-slowdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-devel-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-devel-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-devel-fastdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-devel-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-devel-slowdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-devel-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-fastdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-headless-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-headless-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-headless-fastdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-headless-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-headless-slowdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-headless-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-javadoc-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-javadoc-zip-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-jmods-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-jmods-fastdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-jmods-slowdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-slowdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-src-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-src-fastdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-src-slowdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-static-libs-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-static-libs-fastdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:java-17-openjdk-static-libs-slowdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.AUS:java-17-openjdk-1:17.0.21.0.9-2.1.el8.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.AUS:java-17-openjdk-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.AUS:java-17-openjdk-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.AUS:java-17-openjdk-debugsource-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.AUS:java-17-openjdk-demo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.AUS:java-17-openjdk-devel-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.AUS:java-17-openjdk-devel-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.AUS:java-17-openjdk-headless-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.AUS:java-17-openjdk-headless-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.AUS:java-17-openjdk-javadoc-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.AUS:java-17-openjdk-javadoc-zip-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.AUS:java-17-openjdk-jmods-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.AUS:java-17-openjdk-src-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.AUS:java-17-openjdk-static-libs-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:java-17-openjdk-1:17.0.21.0.9-2.1.el8.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:java-17-openjdk-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:java-17-openjdk-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:java-17-openjdk-debugsource-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:java-17-openjdk-demo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:java-17-openjdk-devel-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:java-17-openjdk-devel-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:java-17-openjdk-headless-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:java-17-openjdk-headless-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:java-17-openjdk-javadoc-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:java-17-openjdk-javadoc-zip-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:java-17-openjdk-jmods-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:java-17-openjdk-src-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:java-17-openjdk-static-libs-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-1:17.0.21.0.9-2.1.el8.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-debuginfo-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-debugsource-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-debugsource-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-demo-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-demo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-devel-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-devel-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-devel-debuginfo-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-devel-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-devel-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-devel-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-devel-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-devel-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-headless-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-headless-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-headless-debuginfo-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-headless-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-headless-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-headless-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-headless-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-headless-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-javadoc-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-javadoc-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-javadoc-zip-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-javadoc-zip-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-jmods-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-jmods-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-src-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-src-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-static-libs-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.E4S:java-17-openjdk-static-libs-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.TUS:java-17-openjdk-1:17.0.21.0.9-2.1.el8.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.TUS:java-17-openjdk-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.TUS:java-17-openjdk-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.TUS:java-17-openjdk-debugsource-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.TUS:java-17-openjdk-demo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.TUS:java-17-openjdk-devel-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.TUS:java-17-openjdk-devel-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.TUS:java-17-openjdk-devel-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.TUS:java-17-openjdk-devel-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.TUS:java-17-openjdk-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.TUS:java-17-openjdk-headless-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.TUS:java-17-openjdk-headless-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.TUS:java-17-openjdk-headless-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.TUS:java-17-openjdk-headless-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.TUS:java-17-openjdk-javadoc-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.TUS:java-17-openjdk-javadoc-zip-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.TUS:java-17-openjdk-jmods-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.TUS:java-17-openjdk-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.TUS:java-17-openjdk-src-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.8.0.Z.TUS:java-17-openjdk-static-libs-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-debuginfo-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-debuginfo-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-debuginfo-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-debugsource-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-debugsource-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-debugsource-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-debugsource-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-demo-fastdebug-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-demo-fastdebug-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-demo-fastdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-demo-slowdebug-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-demo-slowdebug-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-demo-slowdebug-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-demo-slowdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-debuginfo-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-debuginfo-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-debuginfo-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-fastdebug-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-fastdebug-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-fastdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-slowdebug-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-slowdebug-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-slowdebug-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-slowdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-devel-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-fastdebug-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-fastdebug-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-fastdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-debuginfo-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-debuginfo-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-debuginfo-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-fastdebug-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-fastdebug-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-fastdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-fastdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-slowdebug-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-slowdebug-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-slowdebug-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-slowdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-headless-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-jmods-fastdebug-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-jmods-fastdebug-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-jmods-fastdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-jmods-slowdebug-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-jmods-slowdebug-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-jmods-slowdebug-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-jmods-slowdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-slowdebug-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-slowdebug-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-slowdebug-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-slowdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-slowdebug-debuginfo-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-src-fastdebug-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-src-fastdebug-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-src-fastdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-src-slowdebug-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-src-slowdebug-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-src-slowdebug-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-src-slowdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-static-libs-fastdebug-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-static-libs-fastdebug-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-static-libs-fastdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-static-libs-slowdebug-1:17.0.21.0.9-2.1.el8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-static-libs-slowdebug-1:17.0.21.0.9-2.1.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-static-libs-slowdebug-1:17.0.21.0.9-2.1.el8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:java-17-openjdk-static-libs-slowdebug-1:17.0.21.0.9-2.1.el8.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-83376

A flaw was found in the Java Secure Socket Extension (JSSE) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability over a Transport Layer Security (TLS) connection to perform unauthorized modification, insertion, or deletion of accessible data. Exploitation occurs when network services or applications process untrusted network input through affected JSSE APIs, compromising data integrity.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-295 - Improper Certificate Validation

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Low

CVE-2026-83380

A flaw was found in OpenJDK within the Java Authentication and Authorization Service (JAAS) component. An unauthenticated remote attacker can exploit this vulnerability over a network by sending data to affected application programming interfaces (APIs). Successful exploitation results in information disclosure, granting unauthorized read access to a subset of accessible data.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-83381

A flaw was found in OpenJDK. An unauthenticated remote attacker can exploit this vulnerability over a network by supplying crafted input to Application Programming Interfaces (APIs) within the Security component. Successful exploitation can result in unauthorized read and modification access to a subset of data accessible to the application.

4.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-303 - Incorrect Implementation of Authentication Algorithm

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-83387

A flaw was found in the Java Database Connectivity (JDBC) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to exposed JDBC application programming interfaces (APIs) or by executing untrusted code. If successfully exploited, this flaw allows an attacker to obtain unauthorized access to critical data, leading to information disclosure.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-611 - Improper Restriction of XML External Entity Reference

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-83395

A flaw was found in OpenJDK. An unauthenticated remote attacker with network access could exploit this vulnerability by submitting crafted data to networking application programming interfaces (APIs). A successful attack could allow unauthorized modification or deletion of accessible data, or result in a partial Denial of Service (DoS).

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-83400

A flaw was found in the Java API for XML Processing (JAXP) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting crafted data across the network to applications that expose JAXP interfaces, such as through a web service. Successful exploitation can result in a partial Denial of Service (DoS), reducing the availability of the application.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-87290

A flaw was found in the Java API for XML Processing (JAXP) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to applications or web services that rely on vulnerable JAXP APIs. Successful exploitation can result in unauthorized information disclosure, allowing an attacker to access sensitive data managed by the Java application.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-91 - XML Injection (aka Blind XPath Injection)

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-87292

A flaw was found in the OpenJDK networking component. This vulnerability may allow an unauthenticated remote attacker to cause unauthorized data modification. By supplying crafted input to exposed networking application programming interfaces (APIs), such as through a web service, an attacker can insert, update, or delete a subset of accessible data.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Low

CVE-2026-87294

A flaw was found in OpenJDK. An unauthenticated remote attacker can exploit this issue across multiple network protocols by submitting crafted requests to application programming interfaces (APIs) within the Security component. Successful exploitation allows an attacker to modify or delete accessible application data, as well as gain unauthorized read access to sensitive information.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-295 - Improper Certificate Validation

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-87367

A flaw was found in the JAXP (Java API for XML Processing) component of OpenJDK. An unauthenticated remote attacker can exploit this vulnerability by providing crafted input to applications or web services that process data through JAXP APIs. Successful exploitation allows the attacker to perform unauthorized data modifications, including updating, inserting, or deleting accessible data.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-91 - XML Injection (aka Blind XPath Injection)

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Low

CVE-2026-91332

A flaw was found in OpenJDK's Networking component. An unauthenticated remote attacker with network access can exploit this vulnerability by sending crafted input to exposed networking Application Programming Interfaces (APIs). Successful exploitation allows the attacker to perform unauthorized data modifications, potentially inserting, altering, or deleting accessible application data.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-91334

A flaw was found in OpenJDK's ImageIO component. This vulnerability allows an unauthenticated remote attacker to cause information disclosure by submitting crafted inputs to applications or web services using the ImageIO application programming interface (API). Successful exploitation can result in unauthorized read access to a subset of accessible data.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Low

CVE-2026-91335

A flaw was found in OpenJDK's Abstract Window Toolkit (AWT). A remote attacker with low privileges could exploit this vulnerability by convincing a user to run untrusted code within a sandboxed environment. Successful exploitation allows unauthorized read access to a subset of accessible data, leading to information disclosure.

2.6 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

CWE-653 - Improper Isolation or Compartmentalization

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Low

CVE-2026-91373

A flaw was found in OpenJDK's Java Secure Socket Extension (JSSE) component. An unauthenticated remote attacker with network access via Transport Layer Security (TLS) can exploit this vulnerability to cause a partial Denial of Service (DoS). This issue can be triggered when an application or web service processes untrusted network data using the affected JSSE APIs.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-91374

A flaw was found in the Serviceability component of OpenJDK. An unauthenticated remote attacker can exploit this issue across the network by supplying crafted data to exposed application programming interfaces (APIs) or by running untrusted code within a sandboxed Java environment. Successful exploitation may lead to unauthorized data access, allowing the attacker to read and modify sensitive application data.

4.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-749 - Exposed Dangerous Method or Function

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-91375

A flaw was found in openjdk. An unauthenticated attacker with local access to the host system could leverage this vulnerability in the Libraries component by convincing a user to interact with a malicious application or by supplying crafted input through exposed application programming interfaces (APIs). Successful exploitation allows the attacker to compromise data integrity, resulting in the unauthorized modification, creation, or deletion of critical data accessible to the Java runtime environment.

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-91379

A flaw was found in OpenJDK's JDK tools component. An unauthenticated local attacker can exploit this vulnerability by convincing a user to interact with untrusted code in an environment relying on the Java security sandbox. A successful attack can result in unauthorized creation, modification, or deletion of critical data accessible to the application.

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE-653 - Improper Isolation or Compartmentalization

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-91380

A flaw was found in the OpenJDK Utility component. An unauthenticated attacker with local system access or the ability to supply data to affected application programming interfaces (APIs) can exploit this vulnerability. Successful exploitation can result in unauthorized data access, allowing an attacker to read confidential information as well as modify or delete application data.

4.0 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-91382

A flaw was found in OpenJDK's 2D component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted data to an application that processes input using affected 2D APIs. Successful exploitation could allow the attacker to create, modify, or delete accessible data and cause a partial Denial of Service (DoS).

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

CWE-1286 - Improper Validation of Syntactic Correctness of Input

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-91394

A flaw was found in the OpenJDK Networking component. This vulnerability allows an unauthenticated remote attacker with network access to cause an information disclosure. By supplying crafted input to networking Application Programming Interfaces (APIs), such as through an exposed web service, an attacker could exploit this flaw to gain unauthorized access to critical data.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-524 - Use of Cache Containing Sensitive Information

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-91397

A flaw was found in OpenJDK's Serviceability component. An unauthenticated attacker with local access to the host system can exploit this vulnerability with user interaction, such as by supplying crafted input to Serviceability application programming interfaces (APIs). A successful attack can result in unauthorized modification or deletion of accessible data, as well as cause a partial Denial of Service (DoS).

3.6 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

CWE-488 - Exposure of Data Element to Wrong Session

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Low

CVE-2026-91398

A flaw was found in OpenJDK. An unauthenticated remote attacker with network access can exploit this vulnerability through the SOCKS5 (Socket Secure) networking protocol to compromise data integrity. Successful exploitation allows unauthorized creation, modification, or deletion of application data and can extend beyond the Java environment to impact related systems.

6.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

CWE-358 - Improperly Implemented Security Check for Standard

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-91400

A flaw was found in the Sound component of Java SE and GraalVM. This issue allows an unauthenticated remote attacker to cause a partial Denial of Service (DoS) by convincing a user to run untrusted code within a sandboxed Java environment.

3.1 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Low

CVE-2026-91410

A flaw was found in the Libraries component of OpenJDK. An unauthenticated remote attacker with network access can exploit this vulnerability by supplying crafted data to vulnerable application programming interfaces (APIs). Successful exploitation allows the attacker to cause a partial Denial of Service (DoS) of the application or service.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-91415

A flaw was found in OpenJDK's 2D component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to exposed application programming interfaces (APIs), such as through a web service or application that processes graphics data. A successful attack primarily allows an attacker to cause a Denial of Service (DoS) by triggering an application hang or crash, while also potentially permitting unauthorized reading or modification of a subset of accessible data.

4.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-787 - Out-of-bounds Write

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Important

CVE-2026-91418

A flaw was found in OpenJDK's ImageIO component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to applications utilizing ImageIO APIs. Successful exploitation can result in a partial Denial of Service (DoS), degrading application availability.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-91451

A flaw was found in the Networking component of OpenJDK. This vulnerability allows an unauthenticated remote attacker to cause unauthorized data modification by sending crafted input to exposed Application Programming Interfaces (APIs), such as through web services. Successful exploitation enables an attacker to insert, update, or delete data accessible to the application.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-91452

A flaw was found in the Networking component of Oracle Java SE and GraalVM. An unauthenticated remote attacker can exploit this vulnerability by submitting crafted data across the network to exposed application programming interfaces (APIs), such as through a web service. A successful attack can allow an attacker to perform unauthorized modification, insertion, or deletion of accessible data.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-91453

A flaw was found in OpenJDK's Lightweight HTTP Server. An unauthenticated remote attacker can exploit this vulnerability over the network by sending crafted requests to exposed server Application Programming Interfaces (APIs). Successful exploitation allows an attacker to perform unauthorized data modifications, potentially inserting, altering, or deleting accessible application data.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-91461

A flaw was found in the Java Secure Socket Extension (JSSE) component. An unauthenticated remote attacker could exploit this vulnerability over Transport Layer Security (TLS) by sending crafted data to affected application programming interfaces (APIs). A successful attack allows the attacker to cause unauthorized modification, insertion, or deletion of accessible data.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-358 - Improperly Implemented Security Check for Standard

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Low

CVE-2026-91462

A flaw was found in the Java Generic Security Services (JGSS) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted requests to exposed application programming interfaces (APIs), such as through a web service. A successful attack allows the unauthorized creation, deletion, or modification of critical data accessible to the application.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-354 - Improper Validation of Integrity Check Value

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-91463

A flaw was found in the JGSS (Java Generic Security Services) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to execute untrusted code in deployments relying on the Java sandbox. Successful exploitation can result in unauthorized access to sensitive data accessible to the Java environment.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE-749 - Exposed Dangerous Method or Function

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-91464

A flaw was found in OpenJDK's Java Generic Security Services (JGSS) component. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to execute untrusted code within a sandboxed Java environment. Successful exploitation results in unauthorized information disclosure, allowing the attacker to access sensitive data accessible to the application.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE-303 - Incorrect Implementation of Authentication Algorithm

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-91487

A flaw was found in the OpenJDK Compiler component. An unauthenticated remote attacker could exploit this vulnerability by supplying crafted data to exposed application programming interfaces (APIs), such as through a web service. Successful exploitation could allow the attacker to read, update, or delete a subset of accessible data without authorization.

4.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-1025 - Comparison Using Wrong Factors

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

CVE-2026-101516

A flaw was found in the OpenJDK Libraries component. An unauthenticated remote attacker can exploit this vulnerability over a network by submitting crafted data to affected application programming interfaces (APIs), or through sandboxed environments that execute untrusted Java code. Successful exploitation allows the attacker to modify, insert, or delete accessible data, as well as gain unauthorized read access to sensitive information.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-295 - Improper Certificate Validation

Affected products

Fixed 280 products, the same list as for CVE-2026-83374

Threats

Impact Moderate

References

184 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:88352	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2556709	external
https://bugzilla.redhat.com/show_bug.cgi?id=2556795	external
https://bugzilla.redhat.com/show_bug.cgi?id=2556824	external
https://bugzilla.redhat.com/show_bug.cgi?id=2556837	external
https://bugzilla.redhat.com/show_bug.cgi?id=2556859	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557007	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557032	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557041	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557047	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557079	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557110	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557117	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557122	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557195	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557236	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557261	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557356	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557405	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557427	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557443	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557506	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557558	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557564	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557598	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557662	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557665	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557674	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557690	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557709	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557711	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557731	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557765	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557780	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557857	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557906	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557956	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-83374	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557765	external
https://www.cve.org/CVERecord?id=CVE-2026-83374	external
https://nvd.nist.gov/vuln/detail/CVE-2026-83374	external
https://www.oracle.com/security-alerts/cpuoct2026.html	external
https://access.redhat.com/security/cve/CVE-2026-83376	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557427	external
https://www.cve.org/CVERecord?id=CVE-2026-83376	external
https://nvd.nist.gov/vuln/detail/CVE-2026-83376	external
https://access.redhat.com/security/cve/CVE-2026-83380	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557506	external
https://www.cve.org/CVERecord?id=CVE-2026-83380	external
https://nvd.nist.gov/vuln/detail/CVE-2026-83380	external
https://access.redhat.com/security/cve/CVE-2026-83381	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557032	external
https://www.cve.org/CVERecord?id=CVE-2026-83381	external
https://nvd.nist.gov/vuln/detail/CVE-2026-83381	external
https://access.redhat.com/security/cve/CVE-2026-83387	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557122	external
https://www.cve.org/CVERecord?id=CVE-2026-83387	external
https://nvd.nist.gov/vuln/detail/CVE-2026-83387	external
https://access.redhat.com/security/cve/CVE-2026-83395	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557110	external
https://www.cve.org/CVERecord?id=CVE-2026-83395	external
https://nvd.nist.gov/vuln/detail/CVE-2026-83395	external
https://access.redhat.com/security/cve/CVE-2026-83400	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557690	external
https://www.cve.org/CVERecord?id=CVE-2026-83400	external
https://nvd.nist.gov/vuln/detail/CVE-2026-83400	external
https://access.redhat.com/security/cve/CVE-2026-87290	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557731	external
https://www.cve.org/CVERecord?id=CVE-2026-87290	external
https://nvd.nist.gov/vuln/detail/CVE-2026-87290	external
https://access.redhat.com/security/cve/CVE-2026-87292	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557261	external
https://www.cve.org/CVERecord?id=CVE-2026-87292	external
https://nvd.nist.gov/vuln/detail/CVE-2026-87292	external
https://access.redhat.com/security/cve/CVE-2026-87294	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557906	external
https://www.cve.org/CVERecord?id=CVE-2026-87294	external
https://nvd.nist.gov/vuln/detail/CVE-2026-87294	external
https://access.redhat.com/security/cve/CVE-2026-87367	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557558	external
https://www.cve.org/CVERecord?id=CVE-2026-87367	external
https://nvd.nist.gov/vuln/detail/CVE-2026-87367	external
https://access.redhat.com/security/cve/CVE-2026-91332	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557041	external
https://www.cve.org/CVERecord?id=CVE-2026-91332	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91332	external
https://access.redhat.com/security/cve/CVE-2026-91334	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557662	external
https://www.cve.org/CVERecord?id=CVE-2026-91334	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91334	external
https://access.redhat.com/security/cve/CVE-2026-91335	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557598	external
https://www.cve.org/CVERecord?id=CVE-2026-91335	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91335	external
https://access.redhat.com/security/cve/CVE-2026-91373	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557356	external
https://www.cve.org/CVERecord?id=CVE-2026-91373	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91373	external
https://access.redhat.com/security/cve/CVE-2026-91374	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557564	external
https://www.cve.org/CVERecord?id=CVE-2026-91374	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91374	external
https://access.redhat.com/security/cve/CVE-2026-91375	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557857	external
https://www.cve.org/CVERecord?id=CVE-2026-91375	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91375	external
https://access.redhat.com/security/cve/CVE-2026-91379	self
https://bugzilla.redhat.com/show_bug.cgi?id=2556824	external
https://www.cve.org/CVERecord?id=CVE-2026-91379	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91379	external
https://access.redhat.com/security/cve/CVE-2026-91380	self
https://bugzilla.redhat.com/show_bug.cgi?id=2556859	external
https://www.cve.org/CVERecord?id=CVE-2026-91380	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91380	external
https://access.redhat.com/security/cve/CVE-2026-91382	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557665	external
https://www.cve.org/CVERecord?id=CVE-2026-91382	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91382	external
https://access.redhat.com/security/cve/CVE-2026-91394	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557956	external
https://www.cve.org/CVERecord?id=CVE-2026-91394	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91394	external
https://access.redhat.com/security/cve/CVE-2026-91397	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557007	external
https://www.cve.org/CVERecord?id=CVE-2026-91397	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91397	external
https://access.redhat.com/security/cve/CVE-2026-91398	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557711	external
https://www.cve.org/CVERecord?id=CVE-2026-91398	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91398	external
https://access.redhat.com/security/cve/CVE-2026-91400	self
https://bugzilla.redhat.com/show_bug.cgi?id=2556795	external
https://www.cve.org/CVERecord?id=CVE-2026-91400	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91400	external
https://access.redhat.com/security/cve/CVE-2026-91410	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557405	external
https://www.cve.org/CVERecord?id=CVE-2026-91410	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91410	external
https://access.redhat.com/security/cve/CVE-2026-91415	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557443	external
https://www.cve.org/CVERecord?id=CVE-2026-91415	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91415	external
https://access.redhat.com/security/cve/CVE-2026-91418	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557674	external
https://www.cve.org/CVERecord?id=CVE-2026-91418	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91418	external
https://access.redhat.com/security/cve/CVE-2026-91451	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557117	external
https://www.cve.org/CVERecord?id=CVE-2026-91451	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91451	external
https://access.redhat.com/security/cve/CVE-2026-91452	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557195	external
https://www.cve.org/CVERecord?id=CVE-2026-91452	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91452	external
https://access.redhat.com/security/cve/CVE-2026-91453	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557047	external
https://www.cve.org/CVERecord?id=CVE-2026-91453	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91453	external
https://access.redhat.com/security/cve/CVE-2026-91461	self
https://bugzilla.redhat.com/show_bug.cgi?id=2556837	external
https://www.cve.org/CVERecord?id=CVE-2026-91461	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91461	external
https://access.redhat.com/security/cve/CVE-2026-91462	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557236	external
https://www.cve.org/CVERecord?id=CVE-2026-91462	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91462	external
https://access.redhat.com/security/cve/CVE-2026-91463	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557780	external
https://www.cve.org/CVERecord?id=CVE-2026-91463	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91463	external
https://access.redhat.com/security/cve/CVE-2026-91464	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557709	external
https://www.cve.org/CVERecord?id=CVE-2026-91464	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91464	external
https://access.redhat.com/security/cve/CVE-2026-91487	self
https://bugzilla.redhat.com/show_bug.cgi?id=2556709	external
https://www.cve.org/CVERecord?id=CVE-2026-91487	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91487	external
https://access.redhat.com/security/cve/CVE-2026-101516	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557079	external
https://www.cve.org/CVERecord?id=CVE-2026-101516	external
https://nvd.nist.gov/vuln/detail/CVE-2026-101516	external

JSON

To clipboard

Loading 3.2 MB of JSON…

CVE-2026-101516 (GCVE-0-2026-101516)

Vulnerability from cvelistv5 – Published: 2026-10-20 21:21 – Updated: 2026-10-20 21:21

Summary

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE

Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.

Assigner

oracle CNA under the mitre root

CNA scorecard C 69/100 over 3981 records in the last 180 days details

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2026.html	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Oracle Corporation	Oracle Java SE	Affected: 8u503 Affected: 8u503-perf Affected: 11.0.32.1 Affected: 17.0.20.1 Affected: 21.0.12.1 Affected: 25.0.4.1 Affected: 27
Oracle Corporation	Oracle GraalVM for JDK	Affected: 17.0.20.1 Affected: 21.0.12.1
Oracle Corporation	Oracle GraalVM Enterprise Edition	Affected: 21.3.19.1.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Oracle Java SE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8u503"
            },
            {
              "status": "affected",
              "version": "8u503-perf"
            },
            {
              "status": "affected",
              "version": "11.0.32.1"
            },
            {
              "status": "affected",
              "version": "17.0.20.1"
            },
            {
              "status": "affected",
              "version": "21.0.12.1"
            },
            {
              "status": "affected",
              "version": "25.0.4.1"
            },
            {
              "status": "affected",
              "version": "27"
            }
          ]
        },
        {
          "product": "Oracle GraalVM for JDK",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "17.0.20.1"
            },
            {
              "status": "affected",
              "version": "21.0.12.1"
            }
          ]
        },
        {
          "product": "Oracle GraalVM Enterprise Edition",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "21.3.19.1.1"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u503:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u503:*:*:*:enterprise_performance:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:11.0.32.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:17.0.20.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:21.0.12.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:25.0.4.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:27:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.20.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.12.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm:21.3.19.1.1:*:*:*:enterprise:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T21:21:18.319Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-101516",
    "datePublished": "2026-10-20T21:21:18.319Z",
    "dateReserved": "2026-09-28T15:40:09.489Z",
    "dateUpdated": "2026-10-20T21:21:18.319Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-83374 (GCVE-0-2026-83374)

Vulnerability from cvelistv5 – Published: 2026-10-20 21:23 – Updated: 2026-10-27 13:20

Summary

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-27 13:20 UTC

CWE

Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

oracle CNA under the mitre root

CNA scorecard C 69/100 over 3981 records in the last 180 days details

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2026.html	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Oracle Corporation	Oracle Java SE	Affected: 8u503 Affected: 8u503-perf Affected: 11.0.32.1 Affected: 17.0.20.1 Affected: 21.0.12.1 Affected: 25.0.4.1 Affected: 27
Oracle Corporation	Oracle GraalVM for JDK	Affected: 17.0.20.1 Affected: 21.0.12.1
Oracle Corporation	Oracle GraalVM Enterprise Edition	Affected: 21.3.19.1.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-83374",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-27T13:20:44.166447Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-27T13:20:58.910Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Oracle Java SE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8u503"
            },
            {
              "status": "affected",
              "version": "8u503-perf"
            },
            {
              "status": "affected",
              "version": "11.0.32.1"
            },
            {
              "status": "affected",
              "version": "17.0.20.1"
            },
            {
              "status": "affected",
              "version": "21.0.12.1"
            },
            {
              "status": "affected",
              "version": "25.0.4.1"
            },
            {
              "status": "affected",
              "version": "27"
            }
          ]
        },
        {
          "product": "Oracle GraalVM for JDK",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "17.0.20.1"
            },
            {
              "status": "affected",
              "version": "21.0.12.1"
            }
          ]
        },
        {
          "product": "Oracle GraalVM Enterprise Edition",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "21.3.19.1.1"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u503:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u503:*:*:*:enterprise_performance:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:11.0.32.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:17.0.20.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:21.0.12.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:25.0.4.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:27:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.20.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.12.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm:21.3.19.1.1:*:*:*:enterprise:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T21:23:36.480Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-83374",
    "datePublished": "2026-10-20T21:23:36.480Z",
    "dateReserved": "2026-08-31T15:40:57.355Z",
    "dateUpdated": "2026-10-27T13:20:58.910Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-83376 (GCVE-0-2026-83376)

Vulnerability from cvelistv5 – Published: 2026-10-20 21:23 – Updated: 2026-10-27 13:24

Summary

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-27 13:22 UTC

CWE

Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

oracle CNA under the mitre root

CNA scorecard C 69/100 over 3981 records in the last 180 days details

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2026.html	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Oracle Corporation	Oracle Java SE	Affected: 8u503 Affected: 8u503-perf Affected: 11.0.32.1 Affected: 17.0.20.1 Affected: 21.0.12.1 Affected: 25.0.4.1 Affected: 27
Oracle Corporation	Oracle GraalVM for JDK	Affected: 17.0.20.1 Affected: 21.0.12.1
Oracle Corporation	Oracle GraalVM Enterprise Edition	Affected: 21.3.19.1.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-83376",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-27T13:22:34.987692Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-27T13:24:58.718Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Oracle Java SE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8u503"
            },
            {
              "status": "affected",
              "version": "8u503-perf"
            },
            {
              "status": "affected",
              "version": "11.0.32.1"
            },
            {
              "status": "affected",
              "version": "17.0.20.1"
            },
            {
              "status": "affected",
              "version": "21.0.12.1"
            },
            {
              "status": "affected",
              "version": "25.0.4.1"
            },
            {
              "status": "affected",
              "version": "27"
            }
          ]
        },
        {
          "product": "Oracle GraalVM for JDK",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "17.0.20.1"
            },
            {
              "status": "affected",
              "version": "21.0.12.1"
            }
          ]
        },
        {
          "product": "Oracle GraalVM Enterprise Edition",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "21.3.19.1.1"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u503:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u503:*:*:*:enterprise_performance:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:11.0.32.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:17.0.20.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:21.0.12.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:25.0.4.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:27:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.20.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.12.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm:21.3.19.1.1:*:*:*:enterprise:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T21:23:37.211Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-83376",
    "datePublished": "2026-10-20T21:23:37.211Z",
    "dateReserved": "2026-08-31T15:40:57.355Z",
    "dateUpdated": "2026-10-27T13:24:58.718Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-83380 (GCVE-0-2026-83380)

Vulnerability from cvelistv5 – Published: 2026-10-20 21:23 – Updated: 2026-10-27 13:39

Summary

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAAS). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-27 13:38 UTC

CWE

Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

oracle CNA under the mitre root

CNA scorecard C 69/100 over 3981 records in the last 180 days details

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2026.html	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Oracle Corporation	Oracle Java SE	Affected: 8u503 Affected: 8u503-perf Affected: 11.0.32.1 Affected: 17.0.20.1 Affected: 21.0.12.1 Affected: 25.0.4.1 Affected: 27
Oracle Corporation	Oracle GraalVM for JDK	Affected: 17.0.20.1 Affected: 21.0.12.1
Oracle Corporation	Oracle GraalVM Enterprise Edition	Affected: 21.3.19.1.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-83380",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-27T13:38:23.757162Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-27T13:39:42.444Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Oracle Java SE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8u503"
            },
            {
              "status": "affected",
              "version": "8u503-perf"
            },
            {
              "status": "affected",
              "version": "11.0.32.1"
            },
            {
              "status": "affected",
              "version": "17.0.20.1"
            },
            {
              "status": "affected",
              "version": "21.0.12.1"
            },
            {
              "status": "affected",
              "version": "25.0.4.1"
            },
            {
              "status": "affected",
              "version": "27"
            }
          ]
        },
        {
          "product": "Oracle GraalVM for JDK",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "17.0.20.1"
            },
            {
              "status": "affected",
              "version": "21.0.12.1"
            }
          ]
        },
        {
          "product": "Oracle GraalVM Enterprise Edition",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "21.3.19.1.1"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u503:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u503:*:*:*:enterprise_performance:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:11.0.32.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:17.0.20.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:21.0.12.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:25.0.4.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:27:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.20.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.12.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm:21.3.19.1.1:*:*:*:enterprise:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAAS).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T21:23:38.688Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-83380",
    "datePublished": "2026-10-20T21:23:38.688Z",
    "dateReserved": "2026-08-31T15:40:57.356Z",
    "dateUpdated": "2026-10-27T13:39:42.444Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-83381 (GCVE-0-2026-83381)

Vulnerability from cvelistv5 – Published: 2026-10-20 21:23 – Updated: 2026-10-27 13:41

Summary

Vulnerability in Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-27 13:40 UTC

CWE

Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as unauthorized read access to a subset of Oracle Java SE accessible data.
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

oracle CNA under the mitre root

CNA scorecard C 69/100 over 3981 records in the last 180 days details

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2026.html	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	Oracle Java SE	Affected: 8u503 Affected: 8u503-perf Affected: 11.0.32.1 Affected: 17.0.20.1 Affected: 21.0.12.1 Affected: 25.0.4.1 Affected: 27 cpe:2.3:a:oracle:java_se:8u503:::::::* cpe:2.3:a:oracle:java_se:8u503::::enterprise_performance::: cpe:2.3:a:oracle:java_se:11.0.32.1:::::::* cpe:2.3:a:oracle:java_se:17.0.20.1:::::::* cpe:2.3:a:oracle:java_se:21.0.12.1:::::::* cpe:2.3:a:oracle:java_se:25.0.4.1:::::::* cpe:2.3:a:oracle:java_se:27:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-83381",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-27T13:40:39.097164Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-27T13:41:03.875Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Oracle Java SE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8u503"
            },
            {
              "status": "affected",
              "version": "8u503-perf"
            },
            {
              "status": "affected",
              "version": "11.0.32.1"
            },
            {
              "status": "affected",
              "version": "17.0.20.1"
            },
            {
              "status": "affected",
              "version": "21.0.12.1"
            },
            {
              "status": "affected",
              "version": "25.0.4.1"
            },
            {
              "status": "affected",
              "version": "27"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u503:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u503:*:*:*:enterprise_performance:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:11.0.32.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:17.0.20.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:21.0.12.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:25.0.4.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:27:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as  unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as  unauthorized read access to a subset of Oracle Java SE accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T21:23:39.066Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-83381",
    "datePublished": "2026-10-20T21:23:39.066Z",
    "dateReserved": "2026-08-31T15:40:57.356Z",
    "dateUpdated": "2026-10-27T13:41:03.875Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-83387 (GCVE-0-2026-83387)

Vulnerability from cvelistv5 – Published: 2026-10-20 21:23 – Updated: 2026-10-27 14:01

Summary

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JDBC). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-27 14:01 UTC

CWE

Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

oracle CNA under the mitre root

CNA scorecard C 69/100 over 3981 records in the last 180 days details

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2026.html	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Oracle Corporation	Oracle Java SE	Affected: 8u503 Affected: 8u503-perf Affected: 11.0.32.1 Affected: 17.0.20.1 Affected: 21.0.12.1 Affected: 25.0.4.1 Affected: 27
Oracle Corporation	Oracle GraalVM for JDK	Affected: 17.0.20.1 Affected: 21.0.12.1
Oracle Corporation	Oracle GraalVM Enterprise Edition	Affected: 21.3.19.1.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-83387",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-27T14:01:33.011250Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-27T14:01:47.624Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Oracle Java SE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8u503"
            },
            {
              "status": "affected",
              "version": "8u503-perf"
            },
            {
              "status": "affected",
              "version": "11.0.32.1"
            },
            {
              "status": "affected",
              "version": "17.0.20.1"
            },
            {
              "status": "affected",
              "version": "21.0.12.1"
            },
            {
              "status": "affected",
              "version": "25.0.4.1"
            },
            {
              "status": "affected",
              "version": "27"
            }
          ]
        },
        {
          "product": "Oracle GraalVM for JDK",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "17.0.20.1"
            },
            {
              "status": "affected",
              "version": "21.0.12.1"
            }
          ]
        },
        {
          "product": "Oracle GraalVM Enterprise Edition",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "21.3.19.1.1"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u503:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u503:*:*:*:enterprise_performance:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:11.0.32.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:17.0.20.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:21.0.12.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:25.0.4.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:27:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.20.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.12.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm:21.3.19.1.1:*:*:*:enterprise:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JDBC).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T21:23:41.652Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-83387",
    "datePublished": "2026-10-20T21:23:41.652Z",
    "dateReserved": "2026-08-31T15:40:57.356Z",
    "dateUpdated": "2026-10-27T14:01:47.624Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-83395 (GCVE-0-2026-83395)

Vulnerability from cvelistv5 – Published: 2026-10-20 21:23 – Updated: 2026-10-22 18:50

Summary

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-22 18:47 UTC

CWE

Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.
CWE-284 - Improper Access Control

Assigner

oracle CNA under the mitre root

CNA scorecard C 69/100 over 3981 records in the last 180 days details

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2026.html	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Oracle Corporation	Oracle Java SE	Affected: 8u503 Affected: 8u503-perf Affected: 11.0.32.1 Affected: 17.0.20.1 Affected: 21.0.12.1 Affected: 25.0.4.1 Affected: 27
Oracle Corporation	Oracle GraalVM for JDK	Affected: 17.0.20.1 Affected: 21.0.12.1
Oracle Corporation	Oracle GraalVM Enterprise Edition	Affected: 21.3.19.1.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-83395",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-22T18:47:03.739040Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-22T18:50:25.076Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Oracle Java SE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8u503"
            },
            {
              "status": "affected",
              "version": "8u503-perf"
            },
            {
              "status": "affected",
              "version": "11.0.32.1"
            },
            {
              "status": "affected",
              "version": "17.0.20.1"
            },
            {
              "status": "affected",
              "version": "21.0.12.1"
            },
            {
              "status": "affected",
              "version": "25.0.4.1"
            },
            {
              "status": "affected",
              "version": "27"
            }
          ]
        },
        {
          "product": "Oracle GraalVM for JDK",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "17.0.20.1"
            },
            {
              "status": "affected",
              "version": "21.0.12.1"
            }
          ]
        },
        {
          "product": "Oracle GraalVM Enterprise Edition",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "21.3.19.1.1"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u503:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u503:*:*:*:enterprise_performance:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:11.0.32.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:17.0.20.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:21.0.12.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:25.0.4.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:27:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.20.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.12.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm:21.3.19.1.1:*:*:*:enterprise:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T21:23:44.691Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-83395",
    "datePublished": "2026-10-20T21:23:44.691Z",
    "dateReserved": "2026-08-31T15:40:57.356Z",
    "dateUpdated": "2026-10-22T18:50:25.076Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-83400 (GCVE-0-2026-83400)

Vulnerability from cvelistv5 – Published: 2026-10-20 21:23 – Updated: 2026-10-22 18:50

Summary

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-22 18:43 UTC

CWE

Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.
CWE-400 - Uncontrolled Resource Consumption

Assigner

oracle CNA under the mitre root

CNA scorecard C 69/100 over 3981 records in the last 180 days details

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2026.html	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Oracle Corporation	Oracle Java SE	Affected: 8u503 Affected: 8u503-perf Affected: 11.0.32.1 Affected: 17.0.20.1 Affected: 21.0.12.1 Affected: 25.0.4.1 Affected: 27
Oracle Corporation	Oracle GraalVM for JDK	Affected: 17.0.20.1 Affected: 21.0.12.1
Oracle Corporation	Oracle GraalVM Enterprise Edition	Affected: 21.3.19.1.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-83400",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-22T18:43:19.553793Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-22T18:50:24.014Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Oracle Java SE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8u503"
            },
            {
              "status": "affected",
              "version": "8u503-perf"
            },
            {
              "status": "affected",
              "version": "11.0.32.1"
            },
            {
              "status": "affected",
              "version": "17.0.20.1"
            },
            {
              "status": "affected",
              "version": "21.0.12.1"
            },
            {
              "status": "affected",
              "version": "25.0.4.1"
            },
            {
              "status": "affected",
              "version": "27"
            }
          ]
        },
        {
          "product": "Oracle GraalVM for JDK",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "17.0.20.1"
            },
            {
              "status": "affected",
              "version": "21.0.12.1"
            }
          ]
        },
        {
          "product": "Oracle GraalVM Enterprise Edition",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "21.3.19.1.1"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u503:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u503:*:*:*:enterprise_performance:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:11.0.32.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:17.0.20.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:21.0.12.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:25.0.4.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:27:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.20.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.12.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm:21.3.19.1.1:*:*:*:enterprise:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T21:23:46.645Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-83400",
    "datePublished": "2026-10-20T21:23:46.645Z",
    "dateReserved": "2026-08-31T15:40:57.357Z",
    "dateUpdated": "2026-10-22T18:50:24.014Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-87290 (GCVE-0-2026-87290)

Vulnerability from cvelistv5 – Published: 2026-10-20 21:23 – Updated: 2026-10-27 19:37

Summary

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-27 19:37 UTC

CWE

Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

oracle CNA under the mitre root

CNA scorecard C 69/100 over 3981 records in the last 180 days details

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2026.html	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Oracle Corporation	Oracle Java SE	Affected: 8u503 Affected: 8u503-perf Affected: 11.0.32.1 Affected: 17.0.20.1 Affected: 21.0.12.1 Affected: 25.0.4.1 Affected: 27
Oracle Corporation	Oracle GraalVM for JDK	Affected: 17.0.20.1 Affected: 21.0.12.1
Oracle Corporation	Oracle GraalVM Enterprise Edition	Affected: 21.3.19.1.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87290",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-27T19:37:21.066538Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-27T19:37:24.361Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Oracle Java SE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8u503"
            },
            {
              "status": "affected",
              "version": "8u503-perf"
            },
            {
              "status": "affected",
              "version": "11.0.32.1"
            },
            {
              "status": "affected",
              "version": "17.0.20.1"
            },
            {
              "status": "affected",
              "version": "21.0.12.1"
            },
            {
              "status": "affected",
              "version": "25.0.4.1"
            },
            {
              "status": "affected",
              "version": "27"
            }
          ]
        },
        {
          "product": "Oracle GraalVM for JDK",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "17.0.20.1"
            },
            {
              "status": "affected",
              "version": "21.0.12.1"
            }
          ]
        },
        {
          "product": "Oracle GraalVM Enterprise Edition",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "21.3.19.1.1"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u503:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u503:*:*:*:enterprise_performance:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:11.0.32.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:17.0.20.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:21.0.12.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:25.0.4.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:27:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.20.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.12.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm:21.3.19.1.1:*:*:*:enterprise:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T21:23:51.453Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-87290",
    "datePublished": "2026-10-20T21:23:51.453Z",
    "dateReserved": "2026-09-08T21:49:12.409Z",
    "dateUpdated": "2026-10-27T19:37:24.361Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-87292 (GCVE-0-2026-87292)

Vulnerability from cvelistv5 – Published: 2026-10-20 21:23 – Updated: 2026-10-27 18:54

Summary

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-27 18:53 UTC

CWE

Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.
CWE-287 - Improper Authentication

Assigner

oracle CNA under the mitre root

CNA scorecard C 69/100 over 3981 records in the last 180 days details

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2026.html	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Oracle Corporation	Oracle Java SE	Affected: 8u503 Affected: 8u503-perf Affected: 11.0.32.1 Affected: 17.0.20.1 Affected: 21.0.12.1 Affected: 25.0.4.1 Affected: 27
Oracle Corporation	Oracle GraalVM for JDK	Affected: 17.0.20.1 Affected: 21.0.12.1
Oracle Corporation	Oracle GraalVM Enterprise Edition	Affected: 21.3.19.1.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87292",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-27T18:53:29.769338Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-287",
                "description": "CWE-287 Improper Authentication",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-27T18:54:01.116Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Oracle Java SE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8u503"
            },
            {
              "status": "affected",
              "version": "8u503-perf"
            },
            {
              "status": "affected",
              "version": "11.0.32.1"
            },
            {
              "status": "affected",
              "version": "17.0.20.1"
            },
            {
              "status": "affected",
              "version": "21.0.12.1"
            },
            {
              "status": "affected",
              "version": "25.0.4.1"
            },
            {
              "status": "affected",
              "version": "27"
            }
          ]
        },
        {
          "product": "Oracle GraalVM for JDK",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "17.0.20.1"
            },
            {
              "status": "affected",
              "version": "21.0.12.1"
            }
          ]
        },
        {
          "product": "Oracle GraalVM Enterprise Edition",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "21.3.19.1.1"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u503:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u503:*:*:*:enterprise_performance:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:11.0.32.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:17.0.20.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:21.0.12.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:25.0.4.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:27:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.20.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.12.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm:21.3.19.1.1:*:*:*:enterprise:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T21:23:52.207Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-87292",
    "datePublished": "2026-10-20T21:23:52.207Z",
    "dateReserved": "2026-09-08T21:49:12.409Z",
    "dateUpdated": "2026-10-27T18:54:01.116Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:88352

CVE-2026-101516 (GCVE-0-2026-101516)

CVE-2026-83374 (GCVE-0-2026-83374)

CVE-2026-83376 (GCVE-0-2026-83376)

CVE-2026-83380 (GCVE-0-2026-83380)

CVE-2026-83381 (GCVE-0-2026-83381)

CVE-2026-83387 (GCVE-0-2026-83387)

CVE-2026-83395 (GCVE-0-2026-83395)

CVE-2026-83400 (GCVE-0-2026-83400)

CVE-2026-87290 (GCVE-0-2026-87290)

CVE-2026-87292 (GCVE-0-2026-87292)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour