Description
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N).
Published: 2026-08-18
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the networking component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition permits a remote, unauthenticated attacker with HTTP access to read sensitive data or obtain full access to all data exposed by these runtimes. The vulnerability enables the attacker to bypass authorization controls. The vulnerability can affect additional products due to a scope change, raising the confidentiality impact to a complete breach of protected information.

Affected Systems

Affected are Oracle Java SE versions 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, and 26.0.2; Oracle GraalVM for JDK versions 17.0.20 and 21.0.12; and Oracle GraalVM Enterprise Edition version 21.3.19.

Risk and Exploitability

The CVSS 3.1 base score of 6.8 indicates moderate severity. With a network attack vector and high complexity, no privileges or user interaction are required, yet the scope change allows confidentiality compromise. The EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would likely involve crafting a malicious HTTP request to the vulnerable APIs, which can be performed by any host with network connectivity to the target.

Generated by OpenCVE AI on August 21, 2026 at 18:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Oracle Java SE, Oracle GraalVM for JDK, or Oracle GraalVM Enterprise Edition to a version newer than the affected releases listed above.
  • Restrict the exposure of the HTTP endpoints that serve vulnerable APIs to trusted networks only.
  • Configure firewalls to block unsolicited HTTP traffic targeting the Java-based services.
  • If a patch is unavailable, isolate or disable the vulnerable networking APIs until an update is applied.

Generated by OpenCVE AI on August 21, 2026 at 18:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4756-1 openjdk-11 security update
Debian DLA Debian DLA DLA-4757-1 openjdk-17 security update
Debian DSA Debian DSA DSA-6457-1 openjdk-21 security update
Debian DSA Debian DSA DSA-6460-1 openjdk-25 security update
History

Fri, 21 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Fri, 21 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-285

Fri, 21 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Thu, 20 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Oracle graalvm Enterprise Edition
Vendors & Products Oracle graalvm Enterprise Edition

Thu, 20 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access via Java Networking API Exploitation OpenJDK: Enhance HTTP Connections (2026-08 Security Update)
First Time appeared Redhat
Redhat enterprise Linux
Redhat enterprise Linux Eus
Redhat hummingbird
Redhat openjdk
Redhat openjdk Els
Redhat rhel E4s
Redhat rhel Els
Redhat rhel Eus
CPEs cpe:/a:redhat:enterprise_linux:8
cpe:/a:redhat:enterprise_linux:9
cpe:/a:redhat:hummingbird:1
cpe:/a:redhat:openjdk:1.8
cpe:/a:redhat:openjdk:17
cpe:/a:redhat:openjdk:21
cpe:/a:redhat:openjdk:25
cpe:/a:redhat:openjdk_els:11::el7
cpe:/a:redhat:openjdk_els:11::el8
cpe:/a:redhat:openjdk_els:11::el9
cpe:/a:redhat:rhel_e4s:9.4
cpe:/a:redhat:rhel_eus:9.6
cpe:/o:redhat:enterprise_linux:10.2
cpe:/o:redhat:enterprise_linux_eus:10.0
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat
Redhat enterprise Linux
Redhat enterprise Linux Eus
Redhat hummingbird
Redhat openjdk
Redhat openjdk Els
Redhat rhel E4s
Redhat rhel Els
Redhat rhel Eus
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 19 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access via Java Networking API Exploitation
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N).
First Time appeared Oracle
Oracle graalvm
Oracle graalvm For Jdk
Oracle java Se
CPEs cpe:2.3:a:oracle:graalvm:21.3.19:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:17.0.20:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:21.0.12:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:11.0.32:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:17.0.20:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:21.0.12:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:25.0.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:26.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u501:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle graalvm
Oracle graalvm For Jdk
Oracle java Se
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Oracle Graalvm Graalvm Enterprise Edition Graalvm For Jdk Java Se
Redhat Enterprise Linux Enterprise Linux Eus Hummingbird Openjdk Openjdk Els Rhel E4s Rhel Els Rhel Eus
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-21T16:25:32.677Z

Reserved: 2026-07-08T15:52:20.746Z

Link: CVE-2026-61308

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-18T21:16:59.490

Modified: 2026-08-21T17:16:33.830

Link: CVE-2026-61308

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-18T09:09:00Z

Links: CVE-2026-61308 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T19:00:13Z

Weaknesses