Critical Vulnerability in Oracle Java SE and GraalVM Exposes Data to Attackers

## Overview Oracle disclosed a critical vulnerability in Oracle Java SE and GraalVM products. This vulnerability, identified as CVE-2026-114820, has a CVSS score of 9.1, indicating high severity. It affects several versions of Oracle Java SE and GraalVM, allowing unauthenticated attackers with network access to exploit it. ## Technical Details The vulnerability resides in the JSSE component of Oracle Java SE and Oracle GraalVM. Affected versions include Oracle Java SE 8u511-b32, 11.0.33.0.2, 17.0.21.0.2, and others, as well as GraalVM versions 17.0.21.0.2 and 21.3.20.0.2. Attackers can exploit this flaw via multiple protocols, potentially compromising the integrity and confidentiality of data. ## Impact Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data. Attackers may gain complete access to all data accessible by the affected Java SE or GraalVM instances. This vulnerability can also be exploited through APIs in web services or by running untrusted code in sandboxed environments. ## Mitigation Defenders should immediately apply patches provided by Oracle for the affected versions. Regularly update systems to the latest versions to mitigate risks. Additionally, organizations should review their network access controls to limit exposure to potential attackers.