Oracle Java SE and GraalVM JSSE vulnerability allows unauthenticated data access and modification (CVE-2026-114820)

What happened

The CVE record describes a vulnerability in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition, classified under CWE-327 (use of a broken or risky cryptographic algorithm). An unauthenticated attacker with network access to an affected deployment can, without user interaction, read all affected data and create, delete or modify critical data. Availability is not affected.

Oracle notes that the vulnerability can be exploited through APIs in the JSSE component, for example through a web service that supplies data to those APIs. It also applies to Java deployments that run sandboxed Java Web Start applications or sandboxed Java applets from untrusted code and rely on the Java sandbox.

The CVE record indicates no known exploitation or public disclosure, and the vulnerability is not listed in CISA's KEV catalogue.

Who is affected

Affected builds are Oracle Java SE 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2 and 27.0.1.0.2; Oracle GraalVM for JDK 17.0.21.0.2 and 21.0.13.0.2; and Oracle GraalVM Enterprise Edition 21.3.20.0.2. If your environment runs one of these builds, treat it as within the affected scope.

What to do now

1. Inventory installations of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition and identify any matching the builds above. Prioritise hosts that expose Java services or APIs over the network.
2. Apply the updates described in Oracle's Security Alert for CVE-2026-114820. The CVE record marks a fix as available but does not list specific patched build numbers; use Oracle's alert for the exact versions.
3. If patching cannot be done immediately, restrict network access to affected Java services and disable or isolate Java Web Start or applet workloads that load untrusted code until they are updated.
4. Monitor affected systems for unexpected data reads or changes, particularly on services that use JSSE.

How to detect it

The CVE record does not include indicators of compromise. Because the vulnerability is reachable over the network without credentials and can affect data confidentiality and integrity, focus monitoring on exposed Java services and GraalVM deployments for unexpected reads, writes or deletions of critical data.

Beyond the patch

Once Oracle's update is applied, the longer-term exposure is Java runtime sprawl and supplier patch cadence. An unauthenticated, network-reachable flaw in Java SE or GraalVM is exactly the kind of exposed service or open port that Virtual CISO Services (vCISO) helps you identify before an advisory forces the issue. Tracking which runtimes you run across your estate, and how quickly their suppliers fix them, is the work of Supply Chain Defense & Third-Party Risk, because your exposure window is the vendor's patch cycle.