Oracle Java SE and GraalVM JSSE flaw lets unauthenticated attackers read and modify data (CVE-2026-114820)

What happened

Oracle describes CVE-2026-114820 as an easily exploitable vulnerability in the JSSE component of Oracle Java SE and GraalVM. An unauthenticated attacker can reach it over the network through multiple protocols, without any user interaction. A successful attack allows the attacker to read critical data or gain complete access to all data accessible to the affected Java runtime, and to create, delete or modify that data. The CVSS 3.1 score is 9.1 (Critical), with high confidentiality and integrity impact and no availability impact.

The vulnerability can be exploited through APIs in the JSSE component, for example through a web service that supplies data to those APIs. Oracle also notes that it applies to Java deployments that load and run untrusted code in sandboxed Java Web Start applications or sandboxed Java applets. The CVE record does not indicate exploitation in the wild or public disclosure, and CISA's KEV catalogue does not list this CVE.

Who is affected

Oracle lists the following builds as affected:

• Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2
• Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2
• Oracle GraalVM Enterprise Edition: 21.3.20.0.2

Java is widely used across servers, middleware, desktop clients and embedded runtimes, so the main task is to find every installation of these builds. The exposure is particularly relevant where Java applications are reachable over the network or where untrusted code is loaded into a sandbox.

What to do now

1. Apply Oracle's fix. Oracle has published Security Alert CVE-2026-114820 and states that fixes are available. The CVE record does not enumerate the fixed build numbers, so confirm the corrected release for your Java version in Oracle's alert.
2. No workaround is documented in Oracle's alert. Treat patching as the primary control.
3. If an immediate patch is not possible, prioritise inventorying affected Java builds and restricting network access to services that use JSSE APIs, especially internet-facing ones.
4. Re-check downstream vendor products that bundle Oracle Java or GraalVM; they may need their own updates.

How to detect it

Oracle has not published specific indicators of compromise for this CVE. While patching, review logs for unexpected access to Java services using JSSE and for changes to sensitive data handled by those services, but there are no vendor-supplied detection signatures to rely on.

Beyond the patch

Java vulnerabilities with network reach and high integrity impact are rarely limited to a single application; the same runtime is often embedded in vendor products and internal services, so the real work is knowing where those builds are running and which are reachable without credentials. Virtual CISO Services helps map exposed Java services and reduce that attack surface, while Supply Chain Defense & Third-Party Risk helps track which suppliers are still on affected runtimes and how their patch cycles set your exposure window.