CVE-2026-114820

{
  "etk_id": "ETK-2026-2561",
  "cve_id": "CVE-2026-114820",
  "display_id": "CVE-2026-114820",
  "ghsa_id": "GHSA-255q-pwv4-fjj7",
  "euvd_id": "EUVD-2026-109314",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthorized data access via JSSE APIs in Java SE and GraalVM",
  "summary": "Oracle Java SE and the listed Oracle GraalVM releases are affected in the JSSE component. An unauthenticated network attacker may read, create, alter, or delete accessible data when an application supplies attacker-controlled input to affected JSSE APIs. Java clients that run untrusted sandboxed Java Web Start applications or applets may also be exposed.",
  "mitigation": "Apply Oracle's current security update for the affected Java SE or GraalVM deployment after verifying the applicable release in Oracle's advisory; a fixed version is not recorded here. Restrict access to services that pass untrusted data to JSSE APIs, and prevent execution of untrusted sandboxed Java applications until updated.",
  "vendor": "Oracle Corporation",
  "product": "Oracle Java SE",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "8u511-b32",
        "8u511-perf-b32",
        "11.0.33.0.2",
        "17.0.21.0.2",
        "21.0.13.0.2",
        "25.0.5.0.2",
        "27.0.1.0.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Oracle Java SE",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "17.0.21.0.2",
        "21.0.13.0.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Oracle GraalVM for JDK",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "21.3.20.0.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Oracle GraalVM Enterprise Edition",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 23.213072966666665,
  "t0_at": "2026-10-24T18:42:04.571000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-24T18:42:04.571000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-24T18:42:04.571000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114820"
    }
  }
}