Vulnerabilities · 8h ago

Oracle Java flaw exposes data in services and sandboxed clients

Oracle's CVE record assigns CVE-2026-114820 a critical 9.1 score for an unauthenticated network flaw in Oracle Java SE and GraalVM. It affects the Java Secure Socket Extension (JSSE), and the record says an attacker can access or alter data available to the Java process.

JSSE APIs can receive network-supplied data through a web service; using those APIs can be enough to reach the flaw, without a Java login or user interaction. The scope also includes sandboxed Java Web Start applications and applets that run untrusted code and rely on the Java sandbox.

If sandboxed Java clients remain in an environment, they share the exposure with service-side Java: the boundary that matters is where untrusted input reaches JSSE, not whether a Java server is public. The record describes potential reach, not active exploitation.

CVE-2026-114820

NVD KEV

Published Oct 24 by Oracle

CVSS 9.1 CRITICAL: vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).

Timeline

Sources

1 source covering this story

Entities

Part of the PlainSec briefing for 2026-10-24

Editions

Related stories