Description
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
Published: 2026-10-20
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Integrity compromise
Action: Immediate Patch
AI Analysis

Impact

This vulnerability allows an unauthenticated attacker with network access to invoke exposed APIs in Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK, and Oracle Java SE, enabling unauthorized creation, deletion, or modification of critical data. The result is a breach of data integrity because the attacker can alter information that should remain trustworthy. The flaw lies in the security component of these products and does not require user interaction or elevated privileges.

Affected Systems

Affected are Oracle Corporation products: Oracle GraalVM Enterprise Edition version 21.3.19.1.1; Oracle GraalVM for JDK versions 17.0.20.1 and 21.0.12.1; and Oracle Java SE versions 8u503 (including 8u503‑perf), 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27. These versions are susceptible to the described integrity‑compromising flaw.

Risk and Exploitability

The CVSS 3.1 base score of 5.9 denotes a moderate severity focused on integrity; the attack complexity is high and no user interaction is needed. The EPSS score indicates a very low probability of exploitation (< 1%) and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote network access to exposed APIs over multiple protocols; a successful exploitation would allow a remote actor to alter sensitive data. Despite the moderate CVSS, the potential to compromise data integrity across a range of Oracle products makes the risk significant for organizations reliant on these runtimes.

Generated by OpenCVE AI on October 27, 2026 at 19:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest patches or updates for Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK, and Oracle Java SE as specified in Oracle's security advisory.
  • Restrict network exposure of the affected APIs using firewalls, VPNs, or access controls so that only trusted hosts can communicate with the vulnerable services.
  • Disable or isolate sandboxed Java Web Start applications and applets that load untrusted code, and enforce stricter Java Security Manager permissions for any remaining deployments.

Generated by OpenCVE AI on October 27, 2026 at 19:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4861-1 openjdk-17 security update
History

Tue, 27 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle graalvm Enterprise Edition
Oracle oracle Java Se
Vendors & Products Oracle graalvm Enterprise Edition
Oracle oracle Java Se

Thu, 22 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-287

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Integrity Compromise via APIs in Oracle GraalVM and Java SE openjdk: Enhance PKCS5 padding (Oracle CPU 2026-10)
Weaknesses CWE-358
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 22 Oct 2026 08:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Integrity Compromise via APIs in Oracle GraalVM and Java SE
Weaknesses CWE-284
CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
First Time appeared Oracle
Oracle graalvm
Oracle graalvm For Jdk
Oracle java Se
CPEs cpe:2.3:a:oracle:graalvm:21.3.19.1.1:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:17.0.20.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:21.0.12.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:11.0.32.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:17.0.20.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:21.0.12.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:25.0.4.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:27:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u503:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u503:*:*:*:enterprise_performance:*:*:*
Vendors & Products Oracle
Oracle graalvm
Oracle graalvm For Jdk
Oracle java Se
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Oracle Graalvm Graalvm Enterprise Edition Graalvm For Jdk Java Se Oracle Java Se
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T13:20:58.910Z

Reserved: 2026-08-31T15:40:57.355Z

Link: CVE-2026-83374

cve-icon Vulnrichment

Updated: 2026-10-27T13:20:53.293Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:19:53.573

Modified: 2026-10-27T14:17:02.197

Link: CVE-2026-83374

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-20T21:23:36Z

Links: CVE-2026-83374 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T19:30:09Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-358

    Improperly Implemented Security Check for Standard