CVE-2026-21925
published 2026-01-20CVE-2026-21925: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions…
PriorityP426medium4.8CVSS 3.1
AVNACHPRNUINSUCLILAN
EPSS
0.21%
11.5th percentile
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openjdk-11 | < openjdk-11 11.0.30+7-1~deb11u1 (bullseye) | openjdk-11 11.0.30+7-1~deb11u1 (bullseye) |
| debian | openjdk-17 | < openjdk-11 11.0.30+7-1~deb11u1 (bullseye) | openjdk-11 11.0.30+7-1~deb11u1 (bullseye) |
| debian | openjdk-21 | < openjdk-11 11.0.30+7-1~deb11u1 (bullseye) | openjdk-11 11.0.30+7-1~deb11u1 (bullseye) |
| debian | openjdk-25 | < openjdk-11 11.0.30+7-1~deb11u1 (bullseye) | openjdk-11 11.0.30+7-1~deb11u1 (bullseye) |
| debian | openjdk-8 | < openjdk-11 11.0.30+7-1~deb11u1 (bullseye) | openjdk-11 11.0.30+7-1~deb11u1 (bullseye) |
| oracle | graalvm | — | — |
| oracle | graalvm_for_jdk | — | — |
| oracle | graalvm_for_jdk | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle_corporation | oracle_graalvm_enterprise_edition | — | — |
| oracle_corporation | oracle_graalvm_for_jdk | — | — |
| oracle_corporation | oracle_graalvm_for_jdk | — | — |
| oracle_corporation | oracle_java_se | — | — |
| oracle_corporation | oracle_java_se | — | — |
| oracle_corporation | oracle_java_se | — | — |
| oracle_corporation | oracle_java_se | — | — |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
osv4.8MEDIUM
vendor_debian4.8MEDIUM
vendor_oracle4.8MEDIUM
vendor_redhat4.8MEDIUM
vendor_ubuntu4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
OpenJDK 17 vulnerabilities
vendor_ubuntu·2026-02-03·CVSS 4.8
CVE-2026-21945 [MEDIUM] OpenJDK 17 vulnerabilities
Title: OpenJDK 17 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 17.
It was discovered that the RMI component of OpenJDK 17 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 17
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 17
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remo
Ubuntu
OpenJDK 21 vulnerabilities
vendor_ubuntu·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] OpenJDK 21 vulnerabilities
Title: OpenJDK 21 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 21.
It was discovered that the RMI component of OpenJDK 21 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 21
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 21
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remo
Ubuntu
OpenJDK 25 vulnerabilities
vendor_ubuntu·2026-02-02·CVSS 4.8
CVE-2026-21945 [MEDIUM] OpenJDK 25 vulnerabilities
Title: OpenJDK 25 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 25.
It was discovered that the RMI component of OpenJDK 25 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 25
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 25
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remo
Ubuntu
OpenJDK 8 vulnerabilities
vendor_ubuntu·2026-02-02·CVSS 4.8
CVE-2026-21932 [MEDIUM] OpenJDK 8 vulnerabilities
Title: OpenJDK 8 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 8.
It was discovered that the RMI component of OpenJDK 8 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 8
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 8
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote at
Ubuntu
CRaC JDK 21 vulnerabilities
vendor_ubuntu·2026-02-02·CVSS 4.8
CVE-2026-21932 [MEDIUM] CRaC JDK 21 vulnerabilities
Title: CRaC JDK 21 vulnerabilities
Summary: Several security issues were fixed in CRaC JDK 21.
It was discovered that the RMI component of CRaC JDK 21 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 21
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of CRaC JDK 21
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated
Ubuntu
OpenJDK 11 vulnerabilities
vendor_ubuntu·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] OpenJDK 11 vulnerabilities
Title: OpenJDK 11 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 11.
It was discovered that the RMI component of OpenJDK 11 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 11
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 11
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remo
Ubuntu
CRaC JDK 25 vulnerabilities
vendor_ubuntu·2026-02-02·CVSS 4.8
CVE-2026-21932 [MEDIUM] CRaC JDK 25 vulnerabilities
Title: CRaC JDK 25 vulnerabilities
Summary: Several security issues were fixed in CRaC JDK 25.
It was discovered that the RMI component of CRaC JDK 25 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 25
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of CRaC JDK 25
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated
Ubuntu
CRaC JDK 17 vulnerabilities
vendor_ubuntu·2026-02-02·CVSS 4.8
CVE-2026-21945 [MEDIUM] CRaC JDK 17 vulnerabilities
Title: CRaC JDK 17 vulnerabilities
Summary: Several security issues were fixed in CRaC JDK 17.
It was discovered that the RMI component of CRaC JDK 17 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 17
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of CRaC JDK 17
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated
Red Hat
openjdk: Improve JMX connections (Oracle CPU 2026-01)
vendor_redhat·2026-01-20·CVSS 4.8
CVE-2026-21925 [MEDIUM] CWE-322 openjdk: Improve JMX connections (Oracle CPU 2026-01)
openjdk: Improve JMX connections (Oracle CPU 2026-01)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible da
Oracle
Oracle Oracle Java SE Risk Matrix: RMI — CVE-2026-21925
vendor_oracle·2026-01-15·CVSS 4.8
CVE-2026-21925 [MEDIUM] Oracle Oracle Java SE Risk Matrix: RMI — CVE-2026-21925
Oracle Oracle Java SE Risk Matrix: RMI vulnerability
CVE: CVE-2026-21925
CVSS: 4.8
Protocol: Multiple
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2026 (JAN 2026)
Debian
CVE-2026-21925: openjdk-11 - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente...
vendor_debian·2026·CVSS 4.8
CVE-2026-21925 [MEDIUM] CVE-2026-21925: openjdk-11 - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente...
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of O
VulDB
Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition RMI improper authentication (EUVD-2026-3584 / Nessus ID 294885)
vuldb·2026-06-10·CVSS 4.8
CVE-2026-21925 [MEDIUM] Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition RMI improper authentication (EUVD-2026-3584 / Nessus ID 294885)
A vulnerability was found in Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition. It has been rated as critical. The impacted element is an unknown function of the component RMI. The manipulation leads to improper authentication.
This vulnerability is documented as CVE-2026-21925. The attack can be initiated remotely. There is not any exploit available.
Upgrading the affected component is advised.
OSV
openjdk-17 vulnerabilities
osv·2026-02-03·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-17 vulnerabilities
openjdk-17 vulnerabilities
It was discovered that the RMI component of OpenJDK 17 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 17
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 17
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files or leak s
OSV
openjdk-25-crac vulnerabilities
osv·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-25-crac vulnerabilities
openjdk-25-crac vulnerabilities
It was discovered that the RMI component of CRaC JDK 25 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 25
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of CRaC JDK 25
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files o
OSV
openjdk-17-crac vulnerabilities
osv·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-17-crac vulnerabilities
openjdk-17-crac vulnerabilities
It was discovered that the RMI component of CRaC JDK 17 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 17
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of CRaC JDK 17
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files o
OSV
openjdk-25 vulnerabilities
osv·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-25 vulnerabilities
openjdk-25 vulnerabilities
It was discovered that the RMI component of OpenJDK 25 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 25
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 25
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files or leak s
OSV
openjdk-8 vulnerabilities
osv·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-8 vulnerabilities
openjdk-8 vulnerabilities
It was discovered that the RMI component of OpenJDK 8 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 8
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 8
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files or leak sensi
OSV
openjdk-21 vulnerabilities
osv·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-21 vulnerabilities
openjdk-21 vulnerabilities
It was discovered that the RMI component of OpenJDK 21 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 21
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 21
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files or leak s
OSV
openjdk-21-crac vulnerabilities
osv·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-21-crac vulnerabilities
openjdk-21-crac vulnerabilities
It was discovered that the RMI component of CRaC JDK 21 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 21
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of CRaC JDK 21
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files o
OSV
openjdk-lts vulnerabilities
osv·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-lts vulnerabilities
openjdk-lts vulnerabilities
It was discovered that the RMI component of OpenJDK 11 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 11
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 11
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files or leak
GHSA
GHSA-jhg6-g5fp-536p: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI)
ghsa_unreviewed·2026-01-21
CVE-2026-21925 [MEDIUM] GHSA-jhg6-g5fp-536p: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of O
OSV
CVE-2026-21925: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI)
osv·2026-01-20·CVSS 4.8
CVE-2026-21925 [MEDIUM] CVE-2026-21925: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of O
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-21947 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 3.1
CVE-2026-21947 [LOW] CVE-2026-21947 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21947 :
Amazon Corretto JDK vulnerability analysis and mitigation
Vulnerability in Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u471-b50. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely
Wiz
CVE-2026-21925 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.8
CVE-2026-21925 [MEDIUM] CVE-2026-21925 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21925 :
Amazon Corretto JDK vulnerability analysis and mitigation
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterpr
Wiz
CVE-2026-21945 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-21945 [HIGH] CVE-2026-21945 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21945 :
Amazon Corretto JDK vulnerability analysis and mitigation
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalV
Wiz
CVE-2026-21932 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.4
CVE-2026-21932 [HIGH] CVE-2026-21932 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21932 :
Amazon Corretto JDK vulnerability analysis and mitigation
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle Gra
Wiz
CVE-2026-21933 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.1
CVE-2026-21933 [MEDIUM] CVE-2026-21933 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21933 :
Amazon Corretto JDK vulnerability analysis and mitigation
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle Graa
Bugzilla
CVE-2026-21925 openjdk: Improve JMX connections (Oracle CPU 2026-01)
bugzilla·2026-01-15·CVSS 4.8
CVE-2026-21925 [MEDIUM] CVE-2026-21925 openjdk: Improve JMX connections (Oracle CPU 2026-01)
CVE-2026-21925 openjdk: Improve JMX connections (Oracle CPU 2026-01)
A client RMI TCP endpoint connects to the remote host without setting
an endpoint identification algorithm which could allow MITM attacks.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7 Extended Lifecycle Support
Via RHSA-2026:0931 https://access.redhat.com/errata/RHSA-2026:0931
---
OpenJDK-8 upstream commit:
https://github.com/openjdk/jdk8u/commit/f858c7ab3bda7ed5a0babb8e8a29c5e08c640fec
OpenJDK-11 upstream commit:
https://github.com/openjdk/jdk11u/commit/eea83eed5e9f2cbb8ef003c6f54ffb22d5ea98c9
OpenJDK-17 upstream commit:
https://github.com/openjdk/jdk17u/commit/2a6281a2293cf658902c5877b862e16bf02c949c
OpenJDK-21 upstream commit:
https://github.com/openjdk/jdk21
2026-01-20
Published