CVE-2026-114820

OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns

Published Oct 24, 2026 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Analysis

Technical impact

A flaw in the Java Secure Socket Extension (JSSE) component of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition allows an unauthenticated attacker, with network access, to invoke exposed APIs. Successful exploitation can lead to the creation, deletion, or unauthorized modification of critical data, resulting in both confidentiality and integrity compromise of the affected applications.

Affected Systems

Affected systems include Oracle Corporation’s Java SE 8 (8u511-b32, 8u511-perf-b32), Java SE 11 (11.0.33.0.2), Java SE 17 (17.0.21.0.2), Java SE 21 (21.0.13.0.2) and newer Java SE releases (25.0.5.0.2, 27.0.1.0.2), GraalVM for JDK 17.0.21.0.2 and 21.0.13.0.2, and GraalVM Enterprise Edition 21.3.20.0.2. These versions are distributed through Oracle’s Java SE, GraalVM for JDK, and GraalVM Enterprise Edition product lines.

Risk and Exploitability

The CVSS 3.1 score of 9.1 indicates severe confidentiality and integrity impact. The exploit requires no authentication, no user interaction, and can be carried out over various network protocols that expose JSSE APIs, including scenarios that bypass the Java sandbox for applets or Web Start applications. The EPSS score indicates a very low probability of exploitation, less than 1%, and the vulnerability is not listed in the CISA KEV catalog, but the high CVSS and the ease of exploitation make the risk significant.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

Oracle Java SE

affected

Version	Status	Constraints
`8u511-b32`	affected	—
`8u511-perf-b32`	affected	—
`11.0.33.0.2`	affected	—
`17.0.21.0.2`	affected	—
`21.0.13.0.2`	affected	—
`25.0.5.0.2`	affected	—
`27.0.1.0.2`	affected	—

Oracle Corporation

Oracle GraalVM for JDK

affected

Version	Status	Constraints
`17.0.21.0.2`	affected	—
`21.0.13.0.2`	affected	—

Oracle Corporation

Oracle GraalVM Enterprise Edition

affected

Version	Status	Constraints
`21.3.20.0.2`	affected	—

No data.

Package	CPE	Advisory	Released Date
Red Hat Build of OpenJDK 17.0.20.1
java-17-openjdk.win.jdk.x86_64.zip	cpe:/a:redhat:openjdk:17	RHSA-2026:89916	2026-10-27T00:00:00Z
Red Hat Build of OpenJDK 17.0.21
java-17-openjdk.portable.jdk.el.x86_64.tar.xz	cpe:/a:redhat:openjdk:17	RHSA-2026:88353	2026-10-27T00:00:00Z
Red Hat Build of OpenJDK 21.0.12.1
java-21-openjdk.win.jdk.x86_64.zip	cpe:/a:redhat:openjdk:21	RHSA-2026:88350	2026-10-29T00:00:00Z
Red Hat Build of OpenJDK 21.0.13
java-21-openjdk.win.jdk.x86_64.zip	cpe:/a:redhat:openjdk:21	RHSA-2026:88351	2026-10-29T00:00:00Z
Red Hat Build of OpenJDK 25.0.5
java-25-openjdk.portable.jdk.x86_64.tar.xz	cpe:/a:redhat:openjdk:25	RHSA-2026:88348	2026-10-29T00:00:00Z
Temurin Build of OpenJDK 25.0.4.1
java-25-openjdk.win.jdk.x86_64.zip	cpe:/a:redhat:openjdk:25	RHSA-2026:90912	2026-10-29T00:00:00Z

Vendor Product Versions

Oracle

Graalvm Enterprise Edition

Version	Status	Scheme	Platform
`21.3.20.0.2`	affected	generic	—

Oracle

Graalvm For Jdk

Version	Status	Scheme	Platform
`17.0.21.0.2`	affected	generic	—
`21.0.13.0.2`	affected	generic	—

Oracle

Java Se

Version	Status	Scheme	Platform
`8u511-b32`	affected	generic	—
`8u511-perf-b32`	affected	generic	—
`11.0.33.0.2`	affected	generic	—
`17.0.21.0.2`	affected	generic	—
`21.0.13.0.2`	affected	generic	—
`25.0.5.0.2`	affected	generic	—
`27.0.1.0.2`	affected	generic	—

Oracle

Oracle Java Se

Version	Status	Scheme	Platform
`8u511-b32`	affected	generic	—
`8u511-perf-b32`	affected	generic	—
`11.0.33.0.2`	affected	generic	—
`17.0.21.0.2`	affected	generic	—
`21.0.13.0.2`	affected	generic	—
`25.0.5.0.2`	affected	generic	—
`27.0.1.0.2`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Oracle Java SE security patch that addresses CVE‑2026‑114820 and all preceding critical updates
Upgrade Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition to the most recent releases that contain the fix for this CVE
Reduce the exposure of network interfaces that rely on JSSE by restricting or monitoring inter‑network traffic, and consider isolating Java applications in a sandboxed environment until the patch is applied

Generated by OpenCVE AI on October 30, 2026 at 03:26 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9009-1	OpenJDK 8 vulnerabilities
Ubuntu USN	USN-9010-1	OpenJDK 11 vulnerabilities
Ubuntu USN	USN-9014-1	OpenJDK 17 vulnerabilities
Ubuntu USN	USN-9015-1	OpenJDK 21 vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.253% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2026-114820
https://www.cve.org/CVERecord?id=CVE-2026-114820
https://www.oracle.com/security-alerts/alert-cve-2026-114820.html

History

Oct 30, 2026 12:30 AM Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title	JSSE Component Vulnerability Allowing Unauthorized Data Modification and Access in Oracle Java and GraalVM	OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns
First Time appeared		Redhat Redhat openjdk
Weaknesses		CWE-295
CPEs		cpe:/a:redhat:openjdk:17 cpe:/a:redhat:openjdk:21 cpe:/a:redhat:openjdk:25
Vendors & Products		Redhat Redhat openjdk
References		https://nvd.nist.gov/vuln/detail/CVE-2026-114820 https://www.cve.org/CVERecord?id=CVE-2026-114820
Metrics	threat_severity `None`	threat_severity `Critical`

Oct 25, 2026 8:45 AM Title updated View changes

Type	Values Removed	Values Added
Title		JSSE Component Vulnerability Allowing Unauthorized Data Modification and Access in Oracle Java and GraalVM

Oct 25, 2026 6:00 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Oracle Java SE and GraalVM Vulnerability Allowing Unauthorized Data Modification via JSSE
Weaknesses	CWE-20 CWE-284

Oct 25, 2026 1:15 AM Title updated. First appearance in the feed. Weaknesses updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		Oracle Java SE and GraalVM Vulnerability Allowing Unauthorized Data Modification via JSSE
First Time appeared		Oracle graalvm Enterprise Edition Oracle oracle Java Se
Weaknesses		CWE-20 CWE-284 CWE-327
Vendors & Products		Oracle graalvm Enterprise Edition Oracle oracle Java Se
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 24, 2026 6:45 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
First Time appeared		Oracle Oracle graalvm Oracle graalvm For Jdk Oracle java Se
CPEs		cpe:2.3:a:oracle:graalvm:21.3.20.0.2::::enterprise::: cpe:2.3:a:oracle:graalvm_for_jdk:17.0.21.0.2:::::::* cpe:2.3:a:oracle:graalvm_for_jdk:21.0.13.0.2:::::::* cpe:2.3:a:oracle:java_se:::::::: cpe:2.3:a:oracle:java_se:11.0.33.0.2:::::::* cpe:2.3:a:oracle:java_se:17.0.21.0.2:::::::* cpe:2.3:a:oracle:java_se:21.0.13.0.2:::::::* cpe:2.3:a:oracle:java_se:25.0.5.0.2:::::::* cpe:2.3:a:oracle:java_se:27.0.1.0.2:::::::*
Vendors & Products		Oracle Oracle graalvm Oracle graalvm For Jdk Oracle java Se
References		https://www.oracle.com/security-alerts/alert-cve-2026-114820.html
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}`