CVE-2026-114820
waiting for further signalsZero needs more public information before it can validate it.GHSA-255q-pwv4-fjj7 ↗EUVD-2026-109314 ↗
description
Oracle Java SE and the listed Oracle GraalVM releases are affected in the JSSE component. An unauthenticated network attacker may read, create, alter, or delete accessible data when an application supplies attacker-controlled input to affected JSSE APIs. Java clients that run untrusted sandboxed Java Web Start applications or applets may also be exposed.
mitigation
Apply Oracle's current security update for the affected Java SE or GraalVM deployment after verifying the applicable release in Oracle's advisory; a fixed version is not recorded here. Restrict access to services that pass untrusted data to JSSE APIs, and prevent execution of untrusted sandboxed Java applications until updated.
outcome
Contextual: an exploit technique exists, but no deterministic check could cover this one.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-24 18:42Zcve_org: trigger signal, started the run
this entry in the feed
GET /api/v1/feed/CVE-2026-114820
{ "etk_id": "ETK-2026-2561", "cve_id": "CVE-2026-114820", "display_id": "CVE-2026-114820", "ghsa_id": "GHSA-255q-pwv4-fjj7", "euvd_id": "EUVD-2026-109314", "status": "published", "anchor_state": "anchored", "title": "Unauthorized data access via JSSE APIs in Java SE and GraalVM", "summary": "Oracle Java SE and the listed Oracle GraalVM releases are affected in the JSSE component. An unauthenticated network attacker may read, create, alter, or delete accessible data when an application supplies attacker-controlled input to affected JSSE APIs. Java clients that run untrusted sandboxed Java Web Start applications or applets may also be exposed.", "mitigation": "Apply Oracle's current security update for the affected Java SE or GraalVM deployment after verifying the applicable release in Oracle's advisory; a fixed version is not recorded here. Restrict access to services that pass untrusted data to JSSE APIs, and prevent execution of untrusted sandboxed Java applications until updated.", "vendor": "Oracle Corporation", "product": "Oracle Java SE", "affected": [ { "affected_notes": [], "affected_ranges": [ "8u511-b32", "8u511-perf-b32", "11.0.33.0.2", "17.0.21.0.2", "21.0.13.0.2", "25.0.5.0.2", "27.0.1.0.2" ], "ecosystem": null, "fixed_versions": [], "package_name": "Oracle Java SE", "purl": null }, { "affected_notes": [], "affected_ranges": [ "17.0.21.0.2", "21.0.13.0.2" ], "ecosystem": null, "fixed_versions": [], "package_name": "Oracle GraalVM for JDK", "purl": null }, { "affected_notes": [], "affected_ranges": [ "21.3.20.0.2" ], "ecosystem": null, "fixed_versions": [], "package_name": "Oracle GraalVM Enterprise Edition", "purl": null } ], "cwes": null, "cvss_score": 9.1, "cvss_src": "cna_vendor", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "contextual", "check": false, "check_confidence_basis": null, "exploit": false, "pipeline_minutes": 23.213072966666665, "t0_at": "2026-10-24T18:42:04.571000+00:00", "signals": { "trigger_signal": { "at": "2026-10-24T18:42:04.571000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-10-24T18:42:04.571000+00:00", "url": "https://www.cve.org/CVERecord?id=CVE-2026-114820" } } }
published 2026-10-24 19:10Z
last change 2026-10-24 23:06Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.