Vulnerability-Lookup

WID-SEC-W-2026-2443

Vulnerability from csaf_certbund - Published: 2026-07-21 22:00 - Updated: 2026-08-02 22:00

Summary

Oracle Java SE: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Die Java Platform, Standard Edition (SE) ist eine Sammlung von Java-APIs (JDK) und der Java Laufzeit Umgebung (JRE).

Angriff: Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Java SE ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Betroffene Betriebssysteme: - Linux - MacOS X - Sonstiges - UNIX - Windows

CVE-2026-41254

Affected products

Known affected 22 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Oracle Java SE 25.0.3 Oracle / Java SE	`cpe:/a:oracle:java_se:25.0.3`	25.0.3
Oracle Java SE 26.0.1 Oracle / Java SE	`cpe:/a:oracle:java_se:26.0.1`	26.0.1
NetApp ActiveIQ Unified Manager for VMware vSphere NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere`	for VMware vSphere
Oracle GraalVM 17.0.19 Oracle / GraalVM	`cpe:/a:oracle:graalvm:17.0.19`	17.0.19
Amazon Corretto <11.0.32.9.1 Amazon / Corretto		<11.0.32.9.1
Oracle GraalVM 21.0.11 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.0.11`	21.0.11
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Oracle GraalVM 21.3.18 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.3.18`	21.3.18
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Oracle Java SE 8u491-perf Oracle / Java SE	`cpe:/a:oracle:java_se:8u491-perf`	8u491-perf
Oracle Java SE 8u491 Oracle / Java SE	`cpe:/a:oracle:java_se:8u491`	8u491
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Oracle Java SE 11.0.31 Oracle / Java SE	`cpe:/a:oracle:java_se:11.0.31`	11.0.31
Oracle Java SE 17.0.19 Oracle / Java SE	`cpe:/a:oracle:java_se:17.0.19`	17.0.19
Amazon Corretto <8.502.07.1 Amazon / Corretto		<8.502.07.1
Oracle Java SE 21.0.11 Oracle / Java SE	`cpe:/a:oracle:java_se:21.0.11`	21.0.11
Azul Zulu Azul	`cpe:/a:azul:zulu:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Open Source OpenJDK Open Source	`cpe:/a:oracle:openjdk:-`	—
NetApp ActiveIQ Unified Manager for Microsoft Windows NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows`	for Microsoft Windows

CVE-2026-46917

Affected products

Known affected 22 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Oracle Java SE 25.0.3 Oracle / Java SE	`cpe:/a:oracle:java_se:25.0.3`	25.0.3
Oracle Java SE 26.0.1 Oracle / Java SE	`cpe:/a:oracle:java_se:26.0.1`	26.0.1
NetApp ActiveIQ Unified Manager for VMware vSphere NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere`	for VMware vSphere
Oracle GraalVM 17.0.19 Oracle / GraalVM	`cpe:/a:oracle:graalvm:17.0.19`	17.0.19
Amazon Corretto <11.0.32.9.1 Amazon / Corretto		<11.0.32.9.1
Oracle GraalVM 21.0.11 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.0.11`	21.0.11
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Oracle GraalVM 21.3.18 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.3.18`	21.3.18
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Oracle Java SE 8u491-perf Oracle / Java SE	`cpe:/a:oracle:java_se:8u491-perf`	8u491-perf
Oracle Java SE 8u491 Oracle / Java SE	`cpe:/a:oracle:java_se:8u491`	8u491
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Oracle Java SE 11.0.31 Oracle / Java SE	`cpe:/a:oracle:java_se:11.0.31`	11.0.31
Oracle Java SE 17.0.19 Oracle / Java SE	`cpe:/a:oracle:java_se:17.0.19`	17.0.19
Amazon Corretto <8.502.07.1 Amazon / Corretto		<8.502.07.1
Oracle Java SE 21.0.11 Oracle / Java SE	`cpe:/a:oracle:java_se:21.0.11`	21.0.11
Azul Zulu Azul	`cpe:/a:azul:zulu:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Open Source OpenJDK Open Source	`cpe:/a:oracle:openjdk:-`	—
NetApp ActiveIQ Unified Manager for Microsoft Windows NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows`	for Microsoft Windows

CVE-2026-46968

Affected products

Known affected 22 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Oracle Java SE 25.0.3 Oracle / Java SE	`cpe:/a:oracle:java_se:25.0.3`	25.0.3
Oracle Java SE 26.0.1 Oracle / Java SE	`cpe:/a:oracle:java_se:26.0.1`	26.0.1
NetApp ActiveIQ Unified Manager for VMware vSphere NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere`	for VMware vSphere
Oracle GraalVM 17.0.19 Oracle / GraalVM	`cpe:/a:oracle:graalvm:17.0.19`	17.0.19
Amazon Corretto <11.0.32.9.1 Amazon / Corretto		<11.0.32.9.1
Oracle GraalVM 21.0.11 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.0.11`	21.0.11
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Oracle GraalVM 21.3.18 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.3.18`	21.3.18
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Oracle Java SE 8u491-perf Oracle / Java SE	`cpe:/a:oracle:java_se:8u491-perf`	8u491-perf
Oracle Java SE 8u491 Oracle / Java SE	`cpe:/a:oracle:java_se:8u491`	8u491
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Oracle Java SE 11.0.31 Oracle / Java SE	`cpe:/a:oracle:java_se:11.0.31`	11.0.31
Oracle Java SE 17.0.19 Oracle / Java SE	`cpe:/a:oracle:java_se:17.0.19`	17.0.19
Amazon Corretto <8.502.07.1 Amazon / Corretto		<8.502.07.1
Oracle Java SE 21.0.11 Oracle / Java SE	`cpe:/a:oracle:java_se:21.0.11`	21.0.11
Azul Zulu Azul	`cpe:/a:azul:zulu:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Open Source OpenJDK Open Source	`cpe:/a:oracle:openjdk:-`	—
NetApp ActiveIQ Unified Manager for Microsoft Windows NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows`	for Microsoft Windows

CVE-2026-47010

Affected products

Known affected 22 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Oracle Java SE 25.0.3 Oracle / Java SE	`cpe:/a:oracle:java_se:25.0.3`	25.0.3
Oracle Java SE 26.0.1 Oracle / Java SE	`cpe:/a:oracle:java_se:26.0.1`	26.0.1
NetApp ActiveIQ Unified Manager for VMware vSphere NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere`	for VMware vSphere
Oracle GraalVM 17.0.19 Oracle / GraalVM	`cpe:/a:oracle:graalvm:17.0.19`	17.0.19
Amazon Corretto <11.0.32.9.1 Amazon / Corretto		<11.0.32.9.1
Oracle GraalVM 21.0.11 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.0.11`	21.0.11
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Oracle GraalVM 21.3.18 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.3.18`	21.3.18
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Oracle Java SE 8u491-perf Oracle / Java SE	`cpe:/a:oracle:java_se:8u491-perf`	8u491-perf
Oracle Java SE 8u491 Oracle / Java SE	`cpe:/a:oracle:java_se:8u491`	8u491
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Oracle Java SE 11.0.31 Oracle / Java SE	`cpe:/a:oracle:java_se:11.0.31`	11.0.31
Oracle Java SE 17.0.19 Oracle / Java SE	`cpe:/a:oracle:java_se:17.0.19`	17.0.19
Amazon Corretto <8.502.07.1 Amazon / Corretto		<8.502.07.1
Oracle Java SE 21.0.11 Oracle / Java SE	`cpe:/a:oracle:java_se:21.0.11`	21.0.11
Azul Zulu Azul	`cpe:/a:azul:zulu:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Open Source OpenJDK Open Source	`cpe:/a:oracle:openjdk:-`	—
NetApp ActiveIQ Unified Manager for Microsoft Windows NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows`	for Microsoft Windows

CVE-2026-47013

Affected products

Known affected 22 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Oracle Java SE 25.0.3 Oracle / Java SE	`cpe:/a:oracle:java_se:25.0.3`	25.0.3
Oracle Java SE 26.0.1 Oracle / Java SE	`cpe:/a:oracle:java_se:26.0.1`	26.0.1
NetApp ActiveIQ Unified Manager for VMware vSphere NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere`	for VMware vSphere
Oracle GraalVM 17.0.19 Oracle / GraalVM	`cpe:/a:oracle:graalvm:17.0.19`	17.0.19
Amazon Corretto <11.0.32.9.1 Amazon / Corretto		<11.0.32.9.1
Oracle GraalVM 21.0.11 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.0.11`	21.0.11
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Oracle GraalVM 21.3.18 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.3.18`	21.3.18
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Oracle Java SE 8u491-perf Oracle / Java SE	`cpe:/a:oracle:java_se:8u491-perf`	8u491-perf
Oracle Java SE 8u491 Oracle / Java SE	`cpe:/a:oracle:java_se:8u491`	8u491
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Oracle Java SE 11.0.31 Oracle / Java SE	`cpe:/a:oracle:java_se:11.0.31`	11.0.31
Oracle Java SE 17.0.19 Oracle / Java SE	`cpe:/a:oracle:java_se:17.0.19`	17.0.19
Amazon Corretto <8.502.07.1 Amazon / Corretto		<8.502.07.1
Oracle Java SE 21.0.11 Oracle / Java SE	`cpe:/a:oracle:java_se:21.0.11`	21.0.11
Azul Zulu Azul	`cpe:/a:azul:zulu:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Open Source OpenJDK Open Source	`cpe:/a:oracle:openjdk:-`	—
NetApp ActiveIQ Unified Manager for Microsoft Windows NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows`	for Microsoft Windows

CVE-2026-47021

Affected products

Known affected 22 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Oracle Java SE 25.0.3 Oracle / Java SE	`cpe:/a:oracle:java_se:25.0.3`	25.0.3
Oracle Java SE 26.0.1 Oracle / Java SE	`cpe:/a:oracle:java_se:26.0.1`	26.0.1
NetApp ActiveIQ Unified Manager for VMware vSphere NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere`	for VMware vSphere
Oracle GraalVM 17.0.19 Oracle / GraalVM	`cpe:/a:oracle:graalvm:17.0.19`	17.0.19
Amazon Corretto <11.0.32.9.1 Amazon / Corretto		<11.0.32.9.1
Oracle GraalVM 21.0.11 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.0.11`	21.0.11
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Oracle GraalVM 21.3.18 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.3.18`	21.3.18
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Oracle Java SE 8u491-perf Oracle / Java SE	`cpe:/a:oracle:java_se:8u491-perf`	8u491-perf
Oracle Java SE 8u491 Oracle / Java SE	`cpe:/a:oracle:java_se:8u491`	8u491
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Oracle Java SE 11.0.31 Oracle / Java SE	`cpe:/a:oracle:java_se:11.0.31`	11.0.31
Oracle Java SE 17.0.19 Oracle / Java SE	`cpe:/a:oracle:java_se:17.0.19`	17.0.19
Amazon Corretto <8.502.07.1 Amazon / Corretto		<8.502.07.1
Oracle Java SE 21.0.11 Oracle / Java SE	`cpe:/a:oracle:java_se:21.0.11`	21.0.11
Azul Zulu Azul	`cpe:/a:azul:zulu:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Open Source OpenJDK Open Source	`cpe:/a:oracle:openjdk:-`	—
NetApp ActiveIQ Unified Manager for Microsoft Windows NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows`	for Microsoft Windows

CVE-2026-47027

Affected products

Known affected 22 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Oracle Java SE 25.0.3 Oracle / Java SE	`cpe:/a:oracle:java_se:25.0.3`	25.0.3
Oracle Java SE 26.0.1 Oracle / Java SE	`cpe:/a:oracle:java_se:26.0.1`	26.0.1
NetApp ActiveIQ Unified Manager for VMware vSphere NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere`	for VMware vSphere
Oracle GraalVM 17.0.19 Oracle / GraalVM	`cpe:/a:oracle:graalvm:17.0.19`	17.0.19
Amazon Corretto <11.0.32.9.1 Amazon / Corretto		<11.0.32.9.1
Oracle GraalVM 21.0.11 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.0.11`	21.0.11
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Oracle GraalVM 21.3.18 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.3.18`	21.3.18
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Oracle Java SE 8u491-perf Oracle / Java SE	`cpe:/a:oracle:java_se:8u491-perf`	8u491-perf
Oracle Java SE 8u491 Oracle / Java SE	`cpe:/a:oracle:java_se:8u491`	8u491
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Oracle Java SE 11.0.31 Oracle / Java SE	`cpe:/a:oracle:java_se:11.0.31`	11.0.31
Oracle Java SE 17.0.19 Oracle / Java SE	`cpe:/a:oracle:java_se:17.0.19`	17.0.19
Amazon Corretto <8.502.07.1 Amazon / Corretto		<8.502.07.1
Oracle Java SE 21.0.11 Oracle / Java SE	`cpe:/a:oracle:java_se:21.0.11`	21.0.11
Azul Zulu Azul	`cpe:/a:azul:zulu:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Open Source OpenJDK Open Source	`cpe:/a:oracle:openjdk:-`	—
NetApp ActiveIQ Unified Manager for Microsoft Windows NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows`	for Microsoft Windows

CVE-2026-47030

Affected products

Known affected 22 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Oracle Java SE 25.0.3 Oracle / Java SE	`cpe:/a:oracle:java_se:25.0.3`	25.0.3
Oracle Java SE 26.0.1 Oracle / Java SE	`cpe:/a:oracle:java_se:26.0.1`	26.0.1
NetApp ActiveIQ Unified Manager for VMware vSphere NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere`	for VMware vSphere
Oracle GraalVM 17.0.19 Oracle / GraalVM	`cpe:/a:oracle:graalvm:17.0.19`	17.0.19
Amazon Corretto <11.0.32.9.1 Amazon / Corretto		<11.0.32.9.1
Oracle GraalVM 21.0.11 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.0.11`	21.0.11
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Oracle GraalVM 21.3.18 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.3.18`	21.3.18
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Oracle Java SE 8u491-perf Oracle / Java SE	`cpe:/a:oracle:java_se:8u491-perf`	8u491-perf
Oracle Java SE 8u491 Oracle / Java SE	`cpe:/a:oracle:java_se:8u491`	8u491
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Oracle Java SE 11.0.31 Oracle / Java SE	`cpe:/a:oracle:java_se:11.0.31`	11.0.31
Oracle Java SE 17.0.19 Oracle / Java SE	`cpe:/a:oracle:java_se:17.0.19`	17.0.19
Amazon Corretto <8.502.07.1 Amazon / Corretto		<8.502.07.1
Oracle Java SE 21.0.11 Oracle / Java SE	`cpe:/a:oracle:java_se:21.0.11`	21.0.11
Azul Zulu Azul	`cpe:/a:azul:zulu:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Open Source OpenJDK Open Source	`cpe:/a:oracle:openjdk:-`	—
NetApp ActiveIQ Unified Manager for Microsoft Windows NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows`	for Microsoft Windows

CVE-2026-47034

Affected products

Known affected 22 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Oracle Java SE 25.0.3 Oracle / Java SE	`cpe:/a:oracle:java_se:25.0.3`	25.0.3
Oracle Java SE 26.0.1 Oracle / Java SE	`cpe:/a:oracle:java_se:26.0.1`	26.0.1
NetApp ActiveIQ Unified Manager for VMware vSphere NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere`	for VMware vSphere
Oracle GraalVM 17.0.19 Oracle / GraalVM	`cpe:/a:oracle:graalvm:17.0.19`	17.0.19
Amazon Corretto <11.0.32.9.1 Amazon / Corretto		<11.0.32.9.1
Oracle GraalVM 21.0.11 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.0.11`	21.0.11
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Oracle GraalVM 21.3.18 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.3.18`	21.3.18
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Oracle Java SE 8u491-perf Oracle / Java SE	`cpe:/a:oracle:java_se:8u491-perf`	8u491-perf
Oracle Java SE 8u491 Oracle / Java SE	`cpe:/a:oracle:java_se:8u491`	8u491
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Oracle Java SE 11.0.31 Oracle / Java SE	`cpe:/a:oracle:java_se:11.0.31`	11.0.31
Oracle Java SE 17.0.19 Oracle / Java SE	`cpe:/a:oracle:java_se:17.0.19`	17.0.19
Amazon Corretto <8.502.07.1 Amazon / Corretto		<8.502.07.1
Oracle Java SE 21.0.11 Oracle / Java SE	`cpe:/a:oracle:java_se:21.0.11`	21.0.11
Azul Zulu Azul	`cpe:/a:azul:zulu:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Open Source OpenJDK Open Source	`cpe:/a:oracle:openjdk:-`	—
NetApp ActiveIQ Unified Manager for Microsoft Windows NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows`	for Microsoft Windows

CVE-2026-47035

Affected products

Known affected 22 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Oracle Java SE 25.0.3 Oracle / Java SE	`cpe:/a:oracle:java_se:25.0.3`	25.0.3
Oracle Java SE 26.0.1 Oracle / Java SE	`cpe:/a:oracle:java_se:26.0.1`	26.0.1
NetApp ActiveIQ Unified Manager for VMware vSphere NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere`	for VMware vSphere
Oracle GraalVM 17.0.19 Oracle / GraalVM	`cpe:/a:oracle:graalvm:17.0.19`	17.0.19
Amazon Corretto <11.0.32.9.1 Amazon / Corretto		<11.0.32.9.1
Oracle GraalVM 21.0.11 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.0.11`	21.0.11
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Oracle GraalVM 21.3.18 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.3.18`	21.3.18
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Oracle Java SE 8u491-perf Oracle / Java SE	`cpe:/a:oracle:java_se:8u491-perf`	8u491-perf
Oracle Java SE 8u491 Oracle / Java SE	`cpe:/a:oracle:java_se:8u491`	8u491
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Oracle Java SE 11.0.31 Oracle / Java SE	`cpe:/a:oracle:java_se:11.0.31`	11.0.31
Oracle Java SE 17.0.19 Oracle / Java SE	`cpe:/a:oracle:java_se:17.0.19`	17.0.19
Amazon Corretto <8.502.07.1 Amazon / Corretto		<8.502.07.1
Oracle Java SE 21.0.11 Oracle / Java SE	`cpe:/a:oracle:java_se:21.0.11`	21.0.11
Azul Zulu Azul	`cpe:/a:azul:zulu:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Open Source OpenJDK Open Source	`cpe:/a:oracle:openjdk:-`	—
NetApp ActiveIQ Unified Manager for Microsoft Windows NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows`	for Microsoft Windows

CVE-2026-47057

Affected products

Known affected 22 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Oracle Java SE 25.0.3 Oracle / Java SE	`cpe:/a:oracle:java_se:25.0.3`	25.0.3
Oracle Java SE 26.0.1 Oracle / Java SE	`cpe:/a:oracle:java_se:26.0.1`	26.0.1
NetApp ActiveIQ Unified Manager for VMware vSphere NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere`	for VMware vSphere
Oracle GraalVM 17.0.19 Oracle / GraalVM	`cpe:/a:oracle:graalvm:17.0.19`	17.0.19
Amazon Corretto <11.0.32.9.1 Amazon / Corretto		<11.0.32.9.1
Oracle GraalVM 21.0.11 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.0.11`	21.0.11
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Oracle GraalVM 21.3.18 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.3.18`	21.3.18
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Oracle Java SE 8u491-perf Oracle / Java SE	`cpe:/a:oracle:java_se:8u491-perf`	8u491-perf
Oracle Java SE 8u491 Oracle / Java SE	`cpe:/a:oracle:java_se:8u491`	8u491
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Oracle Java SE 11.0.31 Oracle / Java SE	`cpe:/a:oracle:java_se:11.0.31`	11.0.31
Oracle Java SE 17.0.19 Oracle / Java SE	`cpe:/a:oracle:java_se:17.0.19`	17.0.19
Amazon Corretto <8.502.07.1 Amazon / Corretto		<8.502.07.1
Oracle Java SE 21.0.11 Oracle / Java SE	`cpe:/a:oracle:java_se:21.0.11`	21.0.11
Azul Zulu Azul	`cpe:/a:azul:zulu:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Open Source OpenJDK Open Source	`cpe:/a:oracle:openjdk:-`	—
NetApp ActiveIQ Unified Manager for Microsoft Windows NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows`	for Microsoft Windows

CVE-2026-47058

Affected products

Known affected 22 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Oracle Java SE 25.0.3 Oracle / Java SE	`cpe:/a:oracle:java_se:25.0.3`	25.0.3
Oracle Java SE 26.0.1 Oracle / Java SE	`cpe:/a:oracle:java_se:26.0.1`	26.0.1
NetApp ActiveIQ Unified Manager for VMware vSphere NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere`	for VMware vSphere
Oracle GraalVM 17.0.19 Oracle / GraalVM	`cpe:/a:oracle:graalvm:17.0.19`	17.0.19
Amazon Corretto <11.0.32.9.1 Amazon / Corretto		<11.0.32.9.1
Oracle GraalVM 21.0.11 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.0.11`	21.0.11
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Oracle GraalVM 21.3.18 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.3.18`	21.3.18
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Oracle Java SE 8u491-perf Oracle / Java SE	`cpe:/a:oracle:java_se:8u491-perf`	8u491-perf
Oracle Java SE 8u491 Oracle / Java SE	`cpe:/a:oracle:java_se:8u491`	8u491
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Oracle Java SE 11.0.31 Oracle / Java SE	`cpe:/a:oracle:java_se:11.0.31`	11.0.31
Oracle Java SE 17.0.19 Oracle / Java SE	`cpe:/a:oracle:java_se:17.0.19`	17.0.19
Amazon Corretto <8.502.07.1 Amazon / Corretto		<8.502.07.1
Oracle Java SE 21.0.11 Oracle / Java SE	`cpe:/a:oracle:java_se:21.0.11`	21.0.11
Azul Zulu Azul	`cpe:/a:azul:zulu:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Open Source OpenJDK Open Source	`cpe:/a:oracle:openjdk:-`	—
NetApp ActiveIQ Unified Manager for Microsoft Windows NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows`	for Microsoft Windows

CVE-2026-47059

Affected products

Known affected 22 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Oracle Java SE 25.0.3 Oracle / Java SE	`cpe:/a:oracle:java_se:25.0.3`	25.0.3
Oracle Java SE 26.0.1 Oracle / Java SE	`cpe:/a:oracle:java_se:26.0.1`	26.0.1
NetApp ActiveIQ Unified Manager for VMware vSphere NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere`	for VMware vSphere
Oracle GraalVM 17.0.19 Oracle / GraalVM	`cpe:/a:oracle:graalvm:17.0.19`	17.0.19
Amazon Corretto <11.0.32.9.1 Amazon / Corretto		<11.0.32.9.1
Oracle GraalVM 21.0.11 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.0.11`	21.0.11
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Oracle GraalVM 21.3.18 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.3.18`	21.3.18
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Oracle Java SE 8u491-perf Oracle / Java SE	`cpe:/a:oracle:java_se:8u491-perf`	8u491-perf
Oracle Java SE 8u491 Oracle / Java SE	`cpe:/a:oracle:java_se:8u491`	8u491
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Oracle Java SE 11.0.31 Oracle / Java SE	`cpe:/a:oracle:java_se:11.0.31`	11.0.31
Oracle Java SE 17.0.19 Oracle / Java SE	`cpe:/a:oracle:java_se:17.0.19`	17.0.19
Amazon Corretto <8.502.07.1 Amazon / Corretto		<8.502.07.1
Oracle Java SE 21.0.11 Oracle / Java SE	`cpe:/a:oracle:java_se:21.0.11`	21.0.11
Azul Zulu Azul	`cpe:/a:azul:zulu:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Open Source OpenJDK Open Source	`cpe:/a:oracle:openjdk:-`	—
NetApp ActiveIQ Unified Manager for Microsoft Windows NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows`	for Microsoft Windows

CVE-2026-47063

Affected products

Known affected 22 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Oracle Java SE 25.0.3 Oracle / Java SE	`cpe:/a:oracle:java_se:25.0.3`	25.0.3
Oracle Java SE 26.0.1 Oracle / Java SE	`cpe:/a:oracle:java_se:26.0.1`	26.0.1
NetApp ActiveIQ Unified Manager for VMware vSphere NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere`	for VMware vSphere
Oracle GraalVM 17.0.19 Oracle / GraalVM	`cpe:/a:oracle:graalvm:17.0.19`	17.0.19
Amazon Corretto <11.0.32.9.1 Amazon / Corretto		<11.0.32.9.1
Oracle GraalVM 21.0.11 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.0.11`	21.0.11
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Oracle GraalVM 21.3.18 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.3.18`	21.3.18
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Oracle Java SE 8u491-perf Oracle / Java SE	`cpe:/a:oracle:java_se:8u491-perf`	8u491-perf
Oracle Java SE 8u491 Oracle / Java SE	`cpe:/a:oracle:java_se:8u491`	8u491
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Oracle Java SE 11.0.31 Oracle / Java SE	`cpe:/a:oracle:java_se:11.0.31`	11.0.31
Oracle Java SE 17.0.19 Oracle / Java SE	`cpe:/a:oracle:java_se:17.0.19`	17.0.19
Amazon Corretto <8.502.07.1 Amazon / Corretto		<8.502.07.1
Oracle Java SE 21.0.11 Oracle / Java SE	`cpe:/a:oracle:java_se:21.0.11`	21.0.11
Azul Zulu Azul	`cpe:/a:azul:zulu:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Open Source OpenJDK Open Source	`cpe:/a:oracle:openjdk:-`	—
NetApp ActiveIQ Unified Manager for Microsoft Windows NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows`	for Microsoft Windows

CVE-2026-60147

Affected products

Known affected 22 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Oracle Java SE 25.0.3 Oracle / Java SE	`cpe:/a:oracle:java_se:25.0.3`	25.0.3
Oracle Java SE 26.0.1 Oracle / Java SE	`cpe:/a:oracle:java_se:26.0.1`	26.0.1
NetApp ActiveIQ Unified Manager for VMware vSphere NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere`	for VMware vSphere
Oracle GraalVM 17.0.19 Oracle / GraalVM	`cpe:/a:oracle:graalvm:17.0.19`	17.0.19
Amazon Corretto <11.0.32.9.1 Amazon / Corretto		<11.0.32.9.1
Oracle GraalVM 21.0.11 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.0.11`	21.0.11
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Oracle GraalVM 21.3.18 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.3.18`	21.3.18
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Oracle Java SE 8u491-perf Oracle / Java SE	`cpe:/a:oracle:java_se:8u491-perf`	8u491-perf
Oracle Java SE 8u491 Oracle / Java SE	`cpe:/a:oracle:java_se:8u491`	8u491
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Oracle Java SE 11.0.31 Oracle / Java SE	`cpe:/a:oracle:java_se:11.0.31`	11.0.31
Oracle Java SE 17.0.19 Oracle / Java SE	`cpe:/a:oracle:java_se:17.0.19`	17.0.19
Amazon Corretto <8.502.07.1 Amazon / Corretto		<8.502.07.1
Oracle Java SE 21.0.11 Oracle / Java SE	`cpe:/a:oracle:java_se:21.0.11`	21.0.11
Azul Zulu Azul	`cpe:/a:azul:zulu:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Open Source OpenJDK Open Source	`cpe:/a:oracle:openjdk:-`	—
NetApp ActiveIQ Unified Manager for Microsoft Windows NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows`	for Microsoft Windows

CVE-2026-60164

Affected products

Known affected 22 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Oracle Java SE 25.0.3 Oracle / Java SE	`cpe:/a:oracle:java_se:25.0.3`	25.0.3
Oracle Java SE 26.0.1 Oracle / Java SE	`cpe:/a:oracle:java_se:26.0.1`	26.0.1
NetApp ActiveIQ Unified Manager for VMware vSphere NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere`	for VMware vSphere
Oracle GraalVM 17.0.19 Oracle / GraalVM	`cpe:/a:oracle:graalvm:17.0.19`	17.0.19
Amazon Corretto <11.0.32.9.1 Amazon / Corretto		<11.0.32.9.1
Oracle GraalVM 21.0.11 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.0.11`	21.0.11
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Oracle GraalVM 21.3.18 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.3.18`	21.3.18
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Oracle Java SE 8u491-perf Oracle / Java SE	`cpe:/a:oracle:java_se:8u491-perf`	8u491-perf
Oracle Java SE 8u491 Oracle / Java SE	`cpe:/a:oracle:java_se:8u491`	8u491
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Oracle Java SE 11.0.31 Oracle / Java SE	`cpe:/a:oracle:java_se:11.0.31`	11.0.31
Oracle Java SE 17.0.19 Oracle / Java SE	`cpe:/a:oracle:java_se:17.0.19`	17.0.19
Amazon Corretto <8.502.07.1 Amazon / Corretto		<8.502.07.1
Oracle Java SE 21.0.11 Oracle / Java SE	`cpe:/a:oracle:java_se:21.0.11`	21.0.11
Azul Zulu Azul	`cpe:/a:azul:zulu:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Open Source OpenJDK Open Source	`cpe:/a:oracle:openjdk:-`	—
NetApp ActiveIQ Unified Manager for Microsoft Windows NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows`	for Microsoft Windows

CVE-2026-60166

Affected products

Known affected 22 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Oracle Java SE 25.0.3 Oracle / Java SE	`cpe:/a:oracle:java_se:25.0.3`	25.0.3
Oracle Java SE 26.0.1 Oracle / Java SE	`cpe:/a:oracle:java_se:26.0.1`	26.0.1
NetApp ActiveIQ Unified Manager for VMware vSphere NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere`	for VMware vSphere
Oracle GraalVM 17.0.19 Oracle / GraalVM	`cpe:/a:oracle:graalvm:17.0.19`	17.0.19
Amazon Corretto <11.0.32.9.1 Amazon / Corretto		<11.0.32.9.1
Oracle GraalVM 21.0.11 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.0.11`	21.0.11
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Oracle GraalVM 21.3.18 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.3.18`	21.3.18
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Oracle Java SE 8u491-perf Oracle / Java SE	`cpe:/a:oracle:java_se:8u491-perf`	8u491-perf
Oracle Java SE 8u491 Oracle / Java SE	`cpe:/a:oracle:java_se:8u491`	8u491
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Oracle Java SE 11.0.31 Oracle / Java SE	`cpe:/a:oracle:java_se:11.0.31`	11.0.31
Oracle Java SE 17.0.19 Oracle / Java SE	`cpe:/a:oracle:java_se:17.0.19`	17.0.19
Amazon Corretto <8.502.07.1 Amazon / Corretto		<8.502.07.1
Oracle Java SE 21.0.11 Oracle / Java SE	`cpe:/a:oracle:java_se:21.0.11`	21.0.11
Azul Zulu Azul	`cpe:/a:azul:zulu:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Open Source OpenJDK Open Source	`cpe:/a:oracle:openjdk:-`	—
NetApp ActiveIQ Unified Manager for Microsoft Windows NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows`	for Microsoft Windows

CVE-2026-60526

Affected products

Known affected 22 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Oracle Java SE 25.0.3 Oracle / Java SE	`cpe:/a:oracle:java_se:25.0.3`	25.0.3
Oracle Java SE 26.0.1 Oracle / Java SE	`cpe:/a:oracle:java_se:26.0.1`	26.0.1
NetApp ActiveIQ Unified Manager for VMware vSphere NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere`	for VMware vSphere
Oracle GraalVM 17.0.19 Oracle / GraalVM	`cpe:/a:oracle:graalvm:17.0.19`	17.0.19
Amazon Corretto <11.0.32.9.1 Amazon / Corretto		<11.0.32.9.1
Oracle GraalVM 21.0.11 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.0.11`	21.0.11
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Oracle GraalVM 21.3.18 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.3.18`	21.3.18
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Oracle Java SE 8u491-perf Oracle / Java SE	`cpe:/a:oracle:java_se:8u491-perf`	8u491-perf
Oracle Java SE 8u491 Oracle / Java SE	`cpe:/a:oracle:java_se:8u491`	8u491
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Oracle Java SE 11.0.31 Oracle / Java SE	`cpe:/a:oracle:java_se:11.0.31`	11.0.31
Oracle Java SE 17.0.19 Oracle / Java SE	`cpe:/a:oracle:java_se:17.0.19`	17.0.19
Amazon Corretto <8.502.07.1 Amazon / Corretto		<8.502.07.1
Oracle Java SE 21.0.11 Oracle / Java SE	`cpe:/a:oracle:java_se:21.0.11`	21.0.11
Azul Zulu Azul	`cpe:/a:azul:zulu:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Open Source OpenJDK Open Source	`cpe:/a:oracle:openjdk:-`	—
NetApp ActiveIQ Unified Manager for Microsoft Windows NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows`	for Microsoft Windows

CVE-2026-62574

Affected products

Known affected 22 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Oracle Java SE 25.0.3 Oracle / Java SE	`cpe:/a:oracle:java_se:25.0.3`	25.0.3
Oracle Java SE 26.0.1 Oracle / Java SE	`cpe:/a:oracle:java_se:26.0.1`	26.0.1
NetApp ActiveIQ Unified Manager for VMware vSphere NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere`	for VMware vSphere
Oracle GraalVM 17.0.19 Oracle / GraalVM	`cpe:/a:oracle:graalvm:17.0.19`	17.0.19
Amazon Corretto <11.0.32.9.1 Amazon / Corretto		<11.0.32.9.1
Oracle GraalVM 21.0.11 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.0.11`	21.0.11
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Oracle GraalVM 21.3.18 Oracle / GraalVM	`cpe:/a:oracle:graalvm:21.3.18`	21.3.18
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Oracle Java SE 8u491-perf Oracle / Java SE	`cpe:/a:oracle:java_se:8u491-perf`	8u491-perf
Oracle Java SE 8u491 Oracle / Java SE	`cpe:/a:oracle:java_se:8u491`	8u491
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Oracle Java SE 11.0.31 Oracle / Java SE	`cpe:/a:oracle:java_se:11.0.31`	11.0.31
Oracle Java SE 17.0.19 Oracle / Java SE	`cpe:/a:oracle:java_se:17.0.19`	17.0.19
Amazon Corretto <8.502.07.1 Amazon / Corretto		<8.502.07.1
Oracle Java SE 21.0.11 Oracle / Java SE	`cpe:/a:oracle:java_se:21.0.11`	21.0.11
Azul Zulu Azul	`cpe:/a:azul:zulu:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Open Source OpenJDK Open Source	`cpe:/a:oracle:openjdk:-`	—
NetApp ActiveIQ Unified Manager for Microsoft Windows NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows`	for Microsoft Windows

References

44 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.oracle.com/security-alerts/cpujul2026…	external
https://docs.azul.com/core/release-notes.html	external
https://openjdk.org/groups/vulnerability/advisori…	external
https://github.com/corretto/corretto-11/blob/11.0…	external
https://github.com/corretto/corretto-8/releases	external
https://github.com/corretto/corretto-8/blob/8.502…	external
https://access.redhat.com/errata/RHSA-2026:42887	external
https://access.redhat.com/errata/RHSA-2026:42880	external
https://access.redhat.com/errata/RHSA-2026:42881	external
https://access.redhat.com/errata/RHSA-2026:42895	external
https://access.redhat.com/errata/RHSA-2026:42876	external
https://access.redhat.com/errata/RHSA-2026:42900	external
https://access.redhat.com/errata/RHSA-2026:42897	external
https://access.redhat.com/errata/RHSA-2026:42877	external
https://access.redhat.com/errata/RHSA-2026:42882	external
https://access.redhat.com/errata/RHSA-2026:42889	external
https://access.redhat.com/errata/RHSA-2026:42878	external
https://access.redhat.com/errata/RHSA-2026:42879	external
https://access.redhat.com/errata/RHSA-2026:42893	external
https://access.redhat.com/errata/RHSA-2026:42898	external
https://security.netapp.com/advisory/NTAP-20260724-0019	external
https://security.netapp.com/advisory/NTAP-20260724-0016	external
https://security.netapp.com/advisory/NTAP-20260724-0015	external
https://lists.opensuse.org/archives/list/security…	external
https://lists.opensuse.org/archives/list/security…	external
https://lists.opensuse.org/archives/list/security…	external
https://lists.opensuse.org/archives/list/security…	external
https://errata.build.resf.org/RLSA-2026:42887	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://access.redhat.com/errata/RHSA-2026:46808	external
https://lists.debian.org/debian-lts-announce/2026…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.debian.org/debian-lts-announce/2026…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://access.redhat.com/errata/RHSA-2026:48151	external
https://access.redhat.com/errata/RHSA-2026:48845	external
https://lists.opensuse.org/archives/list/security…	external
https://errata.build.resf.org/RLSA-2026:42899	external
http://linux.oracle.com/errata/ELSA-2026-42899.html	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Die Java Platform, Standard Edition (SE) ist eine Sammlung von Java-APIs (JDK) und der Java Laufzeit Umgebung (JRE).",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Java SE ausnutzen, um die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit zu gef\u00e4hrden.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- MacOS X\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-2443 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2443.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-2443 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2443"
      },
      {
        "category": "external",
        "summary": "Oracle Critical Patch Update Advisory - July 2026 - Appendix Oracle Java SE vom 2026-07-21",
        "url": "https://www.oracle.com/security-alerts/cpujul2026.html#AppendixJAVA"
      },
      {
        "category": "external",
        "summary": "Azul Zulu July 2026 Quarterly Update Release Notes vom 2026-07-21",
        "url": "https://docs.azul.com/core/release-notes.html"
      },
      {
        "category": "external",
        "summary": "OpenJDK Vulnerability Advisory vom 2026-07-21",
        "url": "https://openjdk.org/groups/vulnerability/advisories/2026-07-21"
      },
      {
        "category": "external",
        "summary": "Change Log for Amazon Corretto 11 vom 2026-07-21",
        "url": "https://github.com/corretto/corretto-11/blob/11.0.32.9.1/CHANGELOG.md"
      },
      {
        "category": "external",
        "summary": "Amazon Corretto 8 Releases vom 2026-07-21",
        "url": "https://github.com/corretto/corretto-8/releases"
      },
      {
        "category": "external",
        "summary": "Change Log for Amazon Corretto 8 vom 2026-07-22",
        "url": "https://github.com/corretto/corretto-8/blob/8.502.07.1/CHANGELOG.md"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:42887 vom 2026-07-23",
        "url": "https://access.redhat.com/errata/RHSA-2026:42887"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:42880 vom 2026-07-22",
        "url": "https://access.redhat.com/errata/RHSA-2026:42880"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:42881 vom 2026-07-23",
        "url": "https://access.redhat.com/errata/RHSA-2026:42881"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:42895 vom 2026-07-23",
        "url": "https://access.redhat.com/errata/RHSA-2026:42895"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:42876 vom 2026-07-23",
        "url": "https://access.redhat.com/errata/RHSA-2026:42876"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:42900 vom 2026-07-23",
        "url": "https://access.redhat.com/errata/RHSA-2026:42900"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:42897 vom 2026-07-23",
        "url": "https://access.redhat.com/errata/RHSA-2026:42897"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:42877 vom 2026-07-24",
        "url": "https://access.redhat.com/errata/RHSA-2026:42877"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:42882 vom 2026-07-23",
        "url": "https://access.redhat.com/errata/RHSA-2026:42882"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:42889 vom 2026-07-23",
        "url": "https://access.redhat.com/errata/RHSA-2026:42889"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:42878 vom 2026-07-23",
        "url": "https://access.redhat.com/errata/RHSA-2026:42878"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:42879 vom 2026-07-23",
        "url": "https://access.redhat.com/errata/RHSA-2026:42879"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:42893 vom 2026-07-23",
        "url": "https://access.redhat.com/errata/RHSA-2026:42893"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:42898 vom 2026-07-23",
        "url": "https://access.redhat.com/errata/RHSA-2026:42898"
      },
      {
        "category": "external",
        "summary": "NetApp Security Advisory NTAP-20260724-0019 vom 2026-07-24",
        "url": "https://security.netapp.com/advisory/NTAP-20260724-0019"
      },
      {
        "category": "external",
        "summary": "NetApp Security Advisory NTAP-20260724-0016 vom 2026-07-24",
        "url": "https://security.netapp.com/advisory/NTAP-20260724-0016"
      },
      {
        "category": "external",
        "summary": "NetApp Security Advisory NTAP-20260724-0015 vom 2026-07-24",
        "url": "https://security.netapp.com/advisory/NTAP-20260724-0015"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2026:11363-1 vom 2026-07-26",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UH3I5HDUP5BENKT4RVPLOOR62UWYCPOE/"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2026:11337-1 vom 2026-07-24",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RFCSGTAT2VVTJ5PQ7YJQO6EGIMX7WK33/"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2026:21440-1 vom 2026-07-26",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KV3S2P5JDZTBU5OEFR6UJKSIONHFGK6Z/"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2026:11335-1 vom 2026-07-24",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5AN64S6MELS74RZKEWDCKIWTW6QAHDK3/"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:42887 vom 2026-07-26",
        "url": "https://errata.build.resf.org/RLSA-2026:42887"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:3284-1 vom 2026-07-27",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027948.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:46808 vom 2026-07-27",
        "url": "https://access.redhat.com/errata/RHSA-2026:46808"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-4702 vom 2026-07-28",
        "url": "https://lists.debian.org/debian-lts-announce/2026/07/msg00044.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:22953-1 vom 2026-07-28",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027996.html"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-4703 vom 2026-07-28",
        "url": "https://lists.debian.org/debian-lts-announce/2026/07/msg00045.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:3332-1 vom 2026-07-28",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027986.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:3331-1 vom 2026-07-28",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027988.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:22944-1 vom 2026-07-28",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/028008.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:3406-1 vom 2026-07-29",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/028033.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:48151 vom 2026-07-29",
        "url": "https://access.redhat.com/errata/RHSA-2026:48151"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:48845 vom 2026-07-30",
        "url": "https://access.redhat.com/errata/RHSA-2026:48845"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2026:21467-1 vom 2026-07-30",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VHMXADAKV7AYT5NMXWBJF6KM6EJ4G3Y5/"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:42899 vom 2026-07-31",
        "url": "https://errata.build.resf.org/RLSA-2026:42899"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-42899 vom 2026-08-01",
        "url": "http://linux.oracle.com/errata/ELSA-2026-42899.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Oracle Java SE: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-08-02T22:00:00.000+00:00",
      "generator": {
        "date": "2026-08-03T07:18:29.770+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-2443",
      "initial_release_date": "2026-07-21T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-07-21T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-07-22T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-07-23T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-07-26T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von NetApp, openSUSE und Rocky Enterprise Software Foundation aufgenommen"
        },
        {
          "date": "2026-07-27T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von SUSE und Red Hat aufgenommen"
        },
        {
          "date": "2026-07-28T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von SUSE und Debian aufgenommen"
        },
        {
          "date": "2026-07-29T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von SUSE und Red Hat aufgenommen"
        },
        {
          "date": "2026-07-30T22:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Red Hat und openSUSE aufgenommen"
        },
        {
          "date": "2026-08-02T22:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von Rocky Enterprise Software Foundation und Oracle Linux aufgenommen"
        }
      ],
      "status": "final",
      "version": "9"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c11.0.32.9.1",
                "product": {
                  "name": "Amazon Corretto \u003c11.0.32.9.1",
                  "product_id": "T056997"
                }
              },
              {
                "category": "product_version",
                "name": "11.0.32.9.1",
                "product": {
                  "name": "Amazon Corretto 11.0.32.9.1",
                  "product_id": "T056997-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:amazon:corretto:11.0.32.9.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.502.07.1",
                "product": {
                  "name": "Amazon Corretto \u003c8.502.07.1",
                  "product_id": "T057004"
                }
              },
              {
                "category": "product_version",
                "name": "8.502.07.1",
                "product": {
                  "name": "Amazon Corretto 8.502.07.1",
                  "product_id": "T057004-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:amazon:corretto:8.502.07.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Corretto"
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Azul Zulu",
            "product": {
              "name": "Azul Zulu",
              "product_id": "T036273",
              "product_identification_helper": {
                "cpe": "cpe:/a:azul:zulu:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Azul"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "for VMware vSphere",
                "product": {
                  "name": "NetApp ActiveIQ Unified Manager for VMware vSphere",
                  "product_id": "T025152",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "for Microsoft Windows",
                "product": {
                  "name": "NetApp ActiveIQ Unified Manager for Microsoft Windows",
                  "product_id": "T025631",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "ActiveIQ Unified Manager"
          }
        ],
        "category": "vendor",
        "name": "NetApp"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Open Source OpenJDK",
            "product": {
              "name": "Open Source OpenJDK",
              "product_id": "580789",
              "product_identification_helper": {
                "cpe": "cpe:/a:oracle:openjdk:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "17.0.19",
                "product": {
                  "name": "Oracle GraalVM 17.0.19",
                  "product_id": "T056975",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:graalvm:17.0.19"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "21.0.11",
                "product": {
                  "name": "Oracle GraalVM 21.0.11",
                  "product_id": "T056976",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:graalvm:21.0.11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "21.3.18",
                "product": {
                  "name": "Oracle GraalVM 21.3.18",
                  "product_id": "T056977",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:graalvm:21.3.18"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "GraalVM"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "8u491",
                "product": {
                  "name": "Oracle Java SE 8u491",
                  "product_id": "T056969",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:java_se:8u491"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "11.0.31",
                "product": {
                  "name": "Oracle Java SE 11.0.31",
                  "product_id": "T056970",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:java_se:11.0.31"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "17.0.19",
                "product": {
                  "name": "Oracle Java SE 17.0.19",
                  "product_id": "T056971",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:java_se:17.0.19"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "21.0.11",
                "product": {
                  "name": "Oracle Java SE 21.0.11",
                  "product_id": "T056972",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:java_se:21.0.11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "25.0.3",
                "product": {
                  "name": "Oracle Java SE 25.0.3",
                  "product_id": "T056973",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:java_se:25.0.3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "26.0.1",
                "product": {
                  "name": "Oracle Java SE 26.0.1",
                  "product_id": "T056974",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:java_se:26.0.1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8u491-perf",
                "product": {
                  "name": "Oracle Java SE 8u491-perf",
                  "product_id": "T056978",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:java_se:8u491-perf"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Java SE"
          },
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T056236",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "RESF Rocky Linux",
            "product": {
              "name": "RESF Rocky Linux",
              "product_id": "T054581",
              "product_identification_helper": {
                "cpe": "cpe:/o:resf:rocky_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "RESF"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T054646",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "SUSE openSUSE",
            "product": {
              "name": "SUSE openSUSE",
              "product_id": "T055946",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:opensuse:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-41254",
      "product_status": {
        "known_affected": [
          "T056236",
          "T056973",
          "T056974",
          "T025152",
          "T056975",
          "T056997",
          "T056976",
          "T054581",
          "T056977",
          "67646",
          "T056978",
          "T056969",
          "T055946",
          "T054646",
          "T056970",
          "T056971",
          "T057004",
          "T056972",
          "T036273",
          "2951",
          "580789",
          "T025631"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-41254"
    },
    {
      "cve": "CVE-2026-46917",
      "product_status": {
        "known_affected": [
          "T056236",
          "T056973",
          "T056974",
          "T025152",
          "T056975",
          "T056997",
          "T056976",
          "T054581",
          "T056977",
          "67646",
          "T056978",
          "T056969",
          "T055946",
          "T054646",
          "T056970",
          "T056971",
          "T057004",
          "T056972",
          "T036273",
          "2951",
          "580789",
          "T025631"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-46917"
    },
    {
      "cve": "CVE-2026-46968",
      "product_status": {
        "known_affected": [
          "T056236",
          "T056973",
          "T056974",
          "T025152",
          "T056975",
          "T056997",
          "T056976",
          "T054581",
          "T056977",
          "67646",
          "T056978",
          "T056969",
          "T055946",
          "T054646",
          "T056970",
          "T056971",
          "T057004",
          "T056972",
          "T036273",
          "2951",
          "580789",
          "T025631"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-46968"
    },
    {
      "cve": "CVE-2026-47010",
      "product_status": {
        "known_affected": [
          "T056236",
          "T056973",
          "T056974",
          "T025152",
          "T056975",
          "T056997",
          "T056976",
          "T054581",
          "T056977",
          "67646",
          "T056978",
          "T056969",
          "T055946",
          "T054646",
          "T056970",
          "T056971",
          "T057004",
          "T056972",
          "T036273",
          "2951",
          "580789",
          "T025631"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-47010"
    },
    {
      "cve": "CVE-2026-47013",
      "product_status": {
        "known_affected": [
          "T056236",
          "T056973",
          "T056974",
          "T025152",
          "T056975",
          "T056997",
          "T056976",
          "T054581",
          "T056977",
          "67646",
          "T056978",
          "T056969",
          "T055946",
          "T054646",
          "T056970",
          "T056971",
          "T057004",
          "T056972",
          "T036273",
          "2951",
          "580789",
          "T025631"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-47013"
    },
    {
      "cve": "CVE-2026-47021",
      "product_status": {
        "known_affected": [
          "T056236",
          "T056973",
          "T056974",
          "T025152",
          "T056975",
          "T056997",
          "T056976",
          "T054581",
          "T056977",
          "67646",
          "T056978",
          "T056969",
          "T055946",
          "T054646",
          "T056970",
          "T056971",
          "T057004",
          "T056972",
          "T036273",
          "2951",
          "580789",
          "T025631"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-47021"
    },
    {
      "cve": "CVE-2026-47027",
      "product_status": {
        "known_affected": [
          "T056236",
          "T056973",
          "T056974",
          "T025152",
          "T056975",
          "T056997",
          "T056976",
          "T054581",
          "T056977",
          "67646",
          "T056978",
          "T056969",
          "T055946",
          "T054646",
          "T056970",
          "T056971",
          "T057004",
          "T056972",
          "T036273",
          "2951",
          "580789",
          "T025631"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-47027"
    },
    {
      "cve": "CVE-2026-47030",
      "product_status": {
        "known_affected": [
          "T056236",
          "T056973",
          "T056974",
          "T025152",
          "T056975",
          "T056997",
          "T056976",
          "T054581",
          "T056977",
          "67646",
          "T056978",
          "T056969",
          "T055946",
          "T054646",
          "T056970",
          "T056971",
          "T057004",
          "T056972",
          "T036273",
          "2951",
          "580789",
          "T025631"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-47030"
    },
    {
      "cve": "CVE-2026-47034",
      "product_status": {
        "known_affected": [
          "T056236",
          "T056973",
          "T056974",
          "T025152",
          "T056975",
          "T056997",
          "T056976",
          "T054581",
          "T056977",
          "67646",
          "T056978",
          "T056969",
          "T055946",
          "T054646",
          "T056970",
          "T056971",
          "T057004",
          "T056972",
          "T036273",
          "2951",
          "580789",
          "T025631"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-47034"
    },
    {
      "cve": "CVE-2026-47035",
      "product_status": {
        "known_affected": [
          "T056236",
          "T056973",
          "T056974",
          "T025152",
          "T056975",
          "T056997",
          "T056976",
          "T054581",
          "T056977",
          "67646",
          "T056978",
          "T056969",
          "T055946",
          "T054646",
          "T056970",
          "T056971",
          "T057004",
          "T056972",
          "T036273",
          "2951",
          "580789",
          "T025631"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-47035"
    },
    {
      "cve": "CVE-2026-47057",
      "product_status": {
        "known_affected": [
          "T056236",
          "T056973",
          "T056974",
          "T025152",
          "T056975",
          "T056997",
          "T056976",
          "T054581",
          "T056977",
          "67646",
          "T056978",
          "T056969",
          "T055946",
          "T054646",
          "T056970",
          "T056971",
          "T057004",
          "T056972",
          "T036273",
          "2951",
          "580789",
          "T025631"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-47057"
    },
    {
      "cve": "CVE-2026-47058",
      "product_status": {
        "known_affected": [
          "T056236",
          "T056973",
          "T056974",
          "T025152",
          "T056975",
          "T056997",
          "T056976",
          "T054581",
          "T056977",
          "67646",
          "T056978",
          "T056969",
          "T055946",
          "T054646",
          "T056970",
          "T056971",
          "T057004",
          "T056972",
          "T036273",
          "2951",
          "580789",
          "T025631"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-47058"
    },
    {
      "cve": "CVE-2026-47059",
      "product_status": {
        "known_affected": [
          "T056236",
          "T056973",
          "T056974",
          "T025152",
          "T056975",
          "T056997",
          "T056976",
          "T054581",
          "T056977",
          "67646",
          "T056978",
          "T056969",
          "T055946",
          "T054646",
          "T056970",
          "T056971",
          "T057004",
          "T056972",
          "T036273",
          "2951",
          "580789",
          "T025631"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-47059"
    },
    {
      "cve": "CVE-2026-47063",
      "product_status": {
        "known_affected": [
          "T056236",
          "T056973",
          "T056974",
          "T025152",
          "T056975",
          "T056997",
          "T056976",
          "T054581",
          "T056977",
          "67646",
          "T056978",
          "T056969",
          "T055946",
          "T054646",
          "T056970",
          "T056971",
          "T057004",
          "T056972",
          "T036273",
          "2951",
          "580789",
          "T025631"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-47063"
    },
    {
      "cve": "CVE-2026-60147",
      "product_status": {
        "known_affected": [
          "T056236",
          "T056973",
          "T056974",
          "T025152",
          "T056975",
          "T056997",
          "T056976",
          "T054581",
          "T056977",
          "67646",
          "T056978",
          "T056969",
          "T055946",
          "T054646",
          "T056970",
          "T056971",
          "T057004",
          "T056972",
          "T036273",
          "2951",
          "580789",
          "T025631"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-60147"
    },
    {
      "cve": "CVE-2026-60164",
      "product_status": {
        "known_affected": [
          "T056236",
          "T056973",
          "T056974",
          "T025152",
          "T056975",
          "T056997",
          "T056976",
          "T054581",
          "T056977",
          "67646",
          "T056978",
          "T056969",
          "T055946",
          "T054646",
          "T056970",
          "T056971",
          "T057004",
          "T056972",
          "T036273",
          "2951",
          "580789",
          "T025631"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-60164"
    },
    {
      "cve": "CVE-2026-60166",
      "product_status": {
        "known_affected": [
          "T056236",
          "T056973",
          "T056974",
          "T025152",
          "T056975",
          "T056997",
          "T056976",
          "T054581",
          "T056977",
          "67646",
          "T056978",
          "T056969",
          "T055946",
          "T054646",
          "T056970",
          "T056971",
          "T057004",
          "T056972",
          "T036273",
          "2951",
          "580789",
          "T025631"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-60166"
    },
    {
      "cve": "CVE-2026-60526",
      "product_status": {
        "known_affected": [
          "T056236",
          "T056973",
          "T056974",
          "T025152",
          "T056975",
          "T056997",
          "T056976",
          "T054581",
          "T056977",
          "67646",
          "T056978",
          "T056969",
          "T055946",
          "T054646",
          "T056970",
          "T056971",
          "T057004",
          "T056972",
          "T036273",
          "2951",
          "580789",
          "T025631"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-60526"
    },
    {
      "cve": "CVE-2026-62574",
      "product_status": {
        "known_affected": [
          "T056236",
          "T056973",
          "T056974",
          "T025152",
          "T056975",
          "T056997",
          "T056976",
          "T054581",
          "T056977",
          "67646",
          "T056978",
          "T056969",
          "T055946",
          "T054646",
          "T056970",
          "T056971",
          "T057004",
          "T056972",
          "T036273",
          "2951",
          "580789",
          "T025631"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-62574"
    }
  ]
}

CVE-2026-41254 (GCVE-0-2026-41254)

Vulnerability from cvelistv5 – Published: 2026-04-18 06:43 – Updated: 2026-05-07 17:33

Summary

Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.

Severity

4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-696 - Incorrect Behavior Order

Assigner

mitre

References

6 references

URL	Tags
https://github.com/mm2/Little-CMS/commit/da6110b1…
https://github.com/mm2/Little-CMS/commit/e0641b18…
https://www.openwall.com/lists/oss-security/2026/…
https://github.com/mm2/Little-CMS/security/adviso…
https://abhinavagarwal07.github.io/posts/lcms2-cu…
https://lists.debian.org/debian-lts-announce/2026…

Impacted products

1 product

Vendor	Product	Version
littlecms	little cms color engine	Affected: 0 , ≤ 2.18 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41254",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-20T16:09:17.782302Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-20T16:09:45.530Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-05-07T17:33:56.924Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00014.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "little cms color engine",
          "vendor": "littlecms",
          "versions": [
            {
              "lessThanOrEqual": "2.18",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:littlecms:little_cms_color_engine:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "2.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-696",
              "description": "CWE-696 Incorrect Behavior Order",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-18T06:43:42.580Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0"
        },
        {
          "url": "https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/04/17/16"
        },
        {
          "url": "https://github.com/mm2/Little-CMS/security/advisories/GHSA-4xp6-rcgg-m9qq"
        },
        {
          "url": "https://abhinavagarwal07.github.io/posts/lcms2-cubesize-overflow/"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-41254",
    "datePublished": "2026-04-18T06:43:13.741Z",
    "dateReserved": "2026-04-18T06:43:13.323Z",
    "dateUpdated": "2026-05-07T17:33:56.924Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46917 (GCVE-0-2026-46917)

Vulnerability from cvelistv5 – Published: 2026-07-21 21:32 – Updated: 2026-07-23 15:19

Summary

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.
CWE-284 - Improper Access Control

Assigner

oracle

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpujul2026.html	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Oracle Corporation	Oracle Java SE	Affected: 11.0.31 Affected: 17.0.19 Affected: 21.0.11 Affected: 25.0.3 Affected: 26.0.1
Oracle Corporation	Oracle GraalVM for JDK	Affected: 17.0.19 Affected: 21.0.11
Oracle Corporation	Oracle GraalVM Enterprise Edition	Affected: 21.3.18

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-46917",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T19:25:53.056581Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T15:19:18.407Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Oracle Java SE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "11.0.31"
            },
            {
              "status": "affected",
              "version": "17.0.19"
            },
            {
              "status": "affected",
              "version": "21.0.11"
            },
            {
              "status": "affected",
              "version": "25.0.3"
            },
            {
              "status": "affected",
              "version": "26.0.1"
            }
          ]
        },
        {
          "product": "Oracle GraalVM for JDK",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "17.0.19"
            },
            {
              "status": "affected",
              "version": "21.0.11"
            }
          ]
        },
        {
          "product": "Oracle GraalVM Enterprise Edition",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "21.3.18"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:11.0.31:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:17.0.19:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:21.0.11:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:25.0.3:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:26.0.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.19:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.11:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm:21.3.18:*:*:*:enterprise:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T21:32:47.601Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-46917",
    "datePublished": "2026-07-21T21:32:47.601Z",
    "dateReserved": "2026-05-18T15:55:10.311Z",
    "dateUpdated": "2026-07-23T15:19:18.407Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46968 (GCVE-0-2026-46968)

Vulnerability from cvelistv5 – Published: 2026-07-21 21:32 – Updated: 2026-07-23 15:17

Summary

Vulnerability in Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data.
CWE-284 - Improper Access Control

Assigner

oracle

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpujul2026.html	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	Oracle Java SE	Affected: 8u491 Affected: 8u491-perf Affected: 11.0.31 Affected: 17.0.19 Affected: 21.0.11 Affected: 25.0.3 Affected: 26.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-46968",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T19:21:55.842668Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T15:17:46.291Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Oracle Java SE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8u491"
            },
            {
              "status": "affected",
              "version": "8u491-perf"
            },
            {
              "status": "affected",
              "version": "11.0.31"
            },
            {
              "status": "affected",
              "version": "17.0.19"
            },
            {
              "status": "affected",
              "version": "21.0.11"
            },
            {
              "status": "affected",
              "version": "25.0.3"
            },
            {
              "status": "affected",
              "version": "26.0.1"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u491:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u491:*:*:*:enterprise_performance:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:11.0.31:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:17.0.19:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:21.0.11:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:25.0.3:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:26.0.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T21:32:50.164Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-46968",
    "datePublished": "2026-07-21T21:32:50.164Z",
    "dateReserved": "2026-05-18T15:55:10.314Z",
    "dateUpdated": "2026-07-23T15:17:46.291Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47010 (GCVE-0-2026-47010)

Vulnerability from cvelistv5 – Published: 2026-07-21 21:33 – Updated: 2026-07-23 14:58

Summary

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.
CWE-284 - Improper Access Control

Assigner

oracle

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpujul2026.html	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Oracle Corporation	Oracle Java SE	Affected: 8u491 Affected: 8u491-perf Affected: 11.0.31 Affected: 17.0.19 Affected: 21.0.11 Affected: 25.0.3 Affected: 26.0.1
Oracle Corporation	Oracle GraalVM for JDK	Affected: 17.0.19 Affected: 21.0.11
Oracle Corporation	Oracle GraalVM Enterprise Edition	Affected: 21.3.18

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47010",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T14:58:30.796473Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T14:58:56.335Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Oracle Java SE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8u491"
            },
            {
              "status": "affected",
              "version": "8u491-perf"
            },
            {
              "status": "affected",
              "version": "11.0.31"
            },
            {
              "status": "affected",
              "version": "17.0.19"
            },
            {
              "status": "affected",
              "version": "21.0.11"
            },
            {
              "status": "affected",
              "version": "25.0.3"
            },
            {
              "status": "affected",
              "version": "26.0.1"
            }
          ]
        },
        {
          "product": "Oracle GraalVM for JDK",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "17.0.19"
            },
            {
              "status": "affected",
              "version": "21.0.11"
            }
          ]
        },
        {
          "product": "Oracle GraalVM Enterprise Edition",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "21.3.18"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u491:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u491:*:*:*:enterprise_performance:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:11.0.31:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:17.0.19:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:21.0.11:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:25.0.3:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:26.0.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.19:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.11:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm:21.3.18:*:*:*:enterprise:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO).  Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T21:33:01.890Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-47010",
    "datePublished": "2026-07-21T21:33:01.890Z",
    "dateReserved": "2026-05-18T15:55:10.316Z",
    "dateUpdated": "2026-07-23T14:58:56.335Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47013 (GCVE-0-2026-47013)

Vulnerability from cvelistv5 – Published: 2026-07-21 21:33 – Updated: 2026-07-23 15:09

Summary

Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Oracle Java SE: 8u491. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE.
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

oracle

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpujul2026.html	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	Oracle Java SE	Affected: 8u491

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47013",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T15:08:32.445689Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T15:09:00.192Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Oracle Java SE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8u491"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u491:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in Oracle Java SE (component: JavaFX).   The supported version that is affected is Oracle Java SE: 8u491. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T21:33:02.941Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-47013",
    "datePublished": "2026-07-21T21:33:02.941Z",
    "dateReserved": "2026-05-18T15:55:10.317Z",
    "dateUpdated": "2026-07-23T15:09:00.192Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47021 (GCVE-0-2026-47021)

Vulnerability from cvelistv5 – Published: 2026-07-21 21:33 – Updated: 2026-07-23 15:22

Summary

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.
CWE-400 - Uncontrolled Resource Consumption

Assigner

oracle

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpujul2026.html	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Oracle Corporation	Oracle Java SE	Affected: 8u491 Affected: 8u491-perf Affected: 11.0.31 Affected: 17.0.19 Affected: 21.0.11 Affected: 25.0.3 Affected: 26.0.1
Oracle Corporation	Oracle GraalVM for JDK	Affected: 17.0.19 Affected: 21.0.11
Oracle Corporation	Oracle GraalVM Enterprise Edition	Affected: 21.3.18

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47021",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T15:21:43.661852Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T15:22:07.794Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Oracle Java SE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8u491"
            },
            {
              "status": "affected",
              "version": "8u491-perf"
            },
            {
              "status": "affected",
              "version": "11.0.31"
            },
            {
              "status": "affected",
              "version": "17.0.19"
            },
            {
              "status": "affected",
              "version": "21.0.11"
            },
            {
              "status": "affected",
              "version": "25.0.3"
            },
            {
              "status": "affected",
              "version": "26.0.1"
            }
          ]
        },
        {
          "product": "Oracle GraalVM for JDK",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "17.0.19"
            },
            {
              "status": "affected",
              "version": "21.0.11"
            }
          ]
        },
        {
          "product": "Oracle GraalVM Enterprise Edition",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "21.3.18"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u491:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u491:*:*:*:enterprise_performance:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:11.0.31:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:17.0.19:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:21.0.11:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:25.0.3:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:26.0.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.19:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.11:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm:21.3.18:*:*:*:enterprise:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T21:33:05.422Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-47021",
    "datePublished": "2026-07-21T21:33:05.422Z",
    "dateReserved": "2026-05-18T15:55:10.317Z",
    "dateUpdated": "2026-07-23T15:22:07.794Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47027 (GCVE-0-2026-47027)

Vulnerability from cvelistv5 – Published: 2026-07-21 21:33 – Updated: 2026-07-23 17:07

Summary

Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE.
CWE-284 - Improper Access Control

Assigner

oracle

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpujul2026.html	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	Oracle Java SE	Affected: 8u491 Affected: 8u491-perf Affected: 11.0.31 Affected: 17.0.19 Affected: 21.0.11 Affected: 25.0.3 Affected: 26.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47027",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T16:54:16.090581Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T17:07:46.826Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Oracle Java SE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8u491"
            },
            {
              "status": "affected",
              "version": "8u491-perf"
            },
            {
              "status": "affected",
              "version": "11.0.31"
            },
            {
              "status": "affected",
              "version": "17.0.19"
            },
            {
              "status": "affected",
              "version": "21.0.11"
            },
            {
              "status": "affected",
              "version": "25.0.3"
            },
            {
              "status": "affected",
              "version": "26.0.1"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u491:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u491:*:*:*:enterprise_performance:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:11.0.31:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:17.0.19:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:21.0.11:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:25.0.3:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:26.0.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T21:33:07.144Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-47027",
    "datePublished": "2026-07-21T21:33:07.144Z",
    "dateReserved": "2026-05-18T15:55:10.317Z",
    "dateUpdated": "2026-07-23T17:07:46.826Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47030 (GCVE-0-2026-47030)

Vulnerability from cvelistv5 – Published: 2026-07-21 21:33 – Updated: 2026-07-23 17:07

Summary

Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data.
CWE-284 - Improper Access Control

Assigner

oracle

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpujul2026.html	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	Oracle Java SE	Affected: 8u491

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47030",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T16:13:25.392698Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T17:07:31.945Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Oracle Java SE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8u491"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u491:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in Oracle Java SE (component: JavaFX).   The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T21:33:07.826Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-47030",
    "datePublished": "2026-07-21T21:33:07.826Z",
    "dateReserved": "2026-05-18T15:55:10.318Z",
    "dateUpdated": "2026-07-23T17:07:31.945Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47034 (GCVE-0-2026-47034)

Vulnerability from cvelistv5 – Published: 2026-07-21 21:33 – Updated: 2026-07-23 17:06

Summary

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data.
CWE-284 - Improper Access Control

Assigner

oracle

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpujul2026.html	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	Oracle Java SE	Affected: 8u491

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47034",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T16:13:28.505042Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T17:06:59.696Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Oracle Java SE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8u491"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u491:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in Oracle Java SE (component: JavaFX).   The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T21:33:09.226Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-47034",
    "datePublished": "2026-07-21T21:33:09.226Z",
    "dateReserved": "2026-05-18T15:55:10.318Z",
    "dateUpdated": "2026-07-23T17:06:59.696Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47035 (GCVE-0-2026-47035)

Vulnerability from cvelistv5 – Published: 2026-07-21 21:33 – Updated: 2026-07-23 17:06

Summary

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data.
CWE-284 - Improper Access Control

Assigner

oracle

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpujul2026.html	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	Oracle Java SE	Affected: 8u491

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47035",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T16:13:30.112976Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T17:06:50.911Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Oracle Java SE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8u491"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u491:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in Oracle Java SE (component: JavaFX).   The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T21:33:09.574Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-47035",
    "datePublished": "2026-07-21T21:33:09.574Z",
    "dateReserved": "2026-05-18T15:55:10.318Z",
    "dateUpdated": "2026-07-23T17:06:50.911Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

WID-SEC-W-2026-2443

CVE-2026-41254 (GCVE-0-2026-41254)

CVE-2026-46917 (GCVE-0-2026-46917)

CVE-2026-46968 (GCVE-0-2026-46968)

CVE-2026-47010 (GCVE-0-2026-47010)

CVE-2026-47013 (GCVE-0-2026-47013)

CVE-2026-47021 (GCVE-0-2026-47021)

CVE-2026-47027 (GCVE-0-2026-47027)

CVE-2026-47030 (GCVE-0-2026-47030)

CVE-2026-47034 (GCVE-0-2026-47034)

CVE-2026-47035 (GCVE-0-2026-47035)

Tags

Sightings

Nomenclature