{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22016", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "state": "PUBLISHED", "assignerShortName": "oracle", "dateReserved": "2026-01-05T18:07:34.728Z", "datePublished": "2026-04-21T20:35:10.242Z", "dateUpdated": "2026-04-22T14:12:01.017Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2026-04-21T20:35:10.242Z"}, "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data."}]}], "affected": [{"vendor": "Oracle Corporation", "product": "Oracle Java SE", "versions": [{"version": "8u481", "status": "affected"}, {"version": "8u481-b50", "status": "affected"}, {"version": "8u481-perf", "status": "affected"}, {"version": "11.0.30", "status": "affected"}, {"version": "17.0.18", "status": "affected"}, {"version": "21.0.10", "status": "affected"}, {"version": "25.0.2", "status": "affected"}, {"version": "26", "status": "affected"}]}, {"vendor": "Oracle Corporation", "product": "Oracle GraalVM for JDK", "versions": [{"version": "17.0.18", "status": "affected"}, {"version": "21.0.10", "status": "affected"}]}, {"vendor": "Oracle Corporation", "product": "Oracle GraalVM Enterprise Edition", "versions": [{"version": "21.3.17", "status": "affected"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:8u481:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*", "versionStartIncluding": "8u481", "versionEndIncluding": "b50"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:8u481:*:*:*:enterprise_performance:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:11.0.30:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:17.0.18:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:21.0.10:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:25.0.2:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:26:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.18:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.10:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:graalvm:21.3.17:*:*:*:enterprise:*:*:*"}]}]}], "descriptions": [{"lang": "en-US", "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."}], "references": [{"url": "https://www.oracle.com/security-alerts/cpuapr2026.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-502", "lang": "en", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T14:11:15.674948Z", "id": "CVE-2026-22016", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T14:12:01.017Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22016", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "state": "PUBLISHED", "assignerShortName": "oracle", "dateReserved": "2026-01-05T18:07:34.728Z", "datePublished": "2026-04-21T20:35:10.242Z", "dateUpdated": "2026-04-22T14:12:01.017Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2026-04-21T20:35:10.242Z"}, "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data."}]}], "affected": [{"vendor": "Oracle Corporation", "product": "Oracle Java SE", "versions": [{"version": "8u481", "status": "affected"}, {"version": "8u481-b50", "status": "affected"}, {"version": "8u481-perf", "status": "affected"}, {"version": "11.0.30", "status": "affected"}, {"version": "17.0.18", "status": "affected"}, {"version": "21.0.10", "status": "affected"}, {"version": "25.0.2", "status": "affected"}, {"version": "26", "status": "affected"}]}, {"vendor": "Oracle Corporation", "product": "Oracle GraalVM for JDK", "versions": [{"version": "17.0.18", "status": "affected"}, {"version": "21.0.10", "status": "affected"}]}, {"vendor": "Oracle Corporation", "product": "Oracle GraalVM Enterprise Edition", "versions": [{"version": "21.3.17", "status": "affected"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:8u481:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*", "versionStartIncluding": "8u481", "versionEndIncluding": "b50"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:8u481:*:*:*:enterprise_performance:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:11.0.30:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:17.0.18:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:21.0.10:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:25.0.2:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:26:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.18:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.10:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:graalvm:21.3.17:*:*:*:enterprise:*:*:*"}]}]}], "descriptions": [{"lang": "en-US", "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."}], "references": [{"url": "https://www.oracle.com/security-alerts/cpuapr2026.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22016", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T14:11:15.674948Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T14:11:56.711Z"}}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:jre:1.8.0:update481:*:*:-:*:*:*", "matchCriteriaId": "2D3819BA-3DBD-4E7A-AB5D-E550263CBBF7", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jre:1.8.0:update481:*:*:enterprise_performance_pack:*:*:*", "matchCriteriaId": "91BD9F52-958E-4D64-A00D-F183530364CA", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jre:1.8.0:update481_b50:*:*:-:*:*:*", "matchCriteriaId": "CE5DA635-B7B3-4E1A-9B1C-5973A615B728", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jre:11.0.30:*:*:*:*:*:*:*", "matchCriteriaId": "37F85D83-BD75-4BE3-9CE6-8429ECCD8FF6", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jre:17.0.18:*:*:*:*:*:*:*", "matchCriteriaId": "A8589FE8-7CD5-44FA-9325-913D3311DE53", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jre:21.0.10:*:*:*:*:*:*:*", "matchCriteriaId": "B46BFB77-EBC7-45CB-868A-4204DFB8B94F", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jre:25.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "27E53593-6BF0-4F3F-942A-B7A5E97012F7", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jre:26:*:*:*:*:*:*:*", "matchCriteriaId": "726A7677-AC58-42AA-809A-38AA8069160A", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update481:*:*:-:*:*:*", "matchCriteriaId": "34640E60-3068-4AAA-BE14-7AF11694E213", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update481:*:*:enterprise_performance_pack:*:*:*", "matchCriteriaId": "600DC6D9-0F42-42D8-81AF-4B7744A71F09", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update481_b50:*:*:-:*:*:*", "matchCriteriaId": "EC91B23D-3BAF-4E1E-9A9D-EE5CCA1ACAE3", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jdk:11.0.30:*:*:*:*:*:*:*", "matchCriteriaId": "A7099EA6-7B33-41F5-9760-BF4617C19C7B", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jdk:17.0.18:*:*:*:*:*:*:*", "matchCriteriaId": "ABF7AF16-10C8-4544-8D33-A10C869D8132", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jdk:21.0.10:*:*:*:*:*:*:*", "matchCriteriaId": "54B529F3-E3EB-4214-B6D4-372EC1ECEE92", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jdk:25.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "DC1E16C1-62E1-4325-AD55-61C5F7584DD0", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jdk:26:*:*:*:*:*:*:*", "matchCriteriaId": "1D96D602-E003-4D50-9D57-3436E04478D4", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:graalvm:21.3.17:*:*:*:enterprise:*:*:*", "matchCriteriaId": "A03023A6-9A6F-40EE-A9BE-5A8EDC1EEE94", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.18:*:*:*:*:*:*:*", "matchCriteriaId": "55B50BFF-7A24-4603-826D-60D80DBF748E", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.10:*:*:*:*:*:*:*", "matchCriteriaId": "A6B951D6-6031-4169-962B-6127A6D7FB6D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."}], "id": "CVE-2026-22016", "lastModified": "2026-04-27T12:16:20.870", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "secalert_us@oracle.com", "type": "Secondary"}]}, "published": "2026-04-21T21:16:28.470", "references": [{"source": "secalert_us@oracle.com", "tags": ["Vendor Advisory"], "url": "https://www.oracle.com/security-alerts/cpuapr2026.html"}], "sourceIdentifier": "secalert_us@oracle.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-502"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "openjdk: OpenJDK: Enhance Path Factories Redux (Oracle CPU 2026-04)", "id": "2460039", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460039"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-611", "details": ["No description is available for this CVE."], "name": "CVE-2026-22016", "package_state": [{"cpe": "cpe:/a:redhat:openjdk_els:11", "fix_state": "Affected", "package_name": "java-11-openjdk", "product_name": "Red Hat build of OpenJDK 11 ELS"}, {"cpe": "cpe:/a:redhat:openjdk_els:11", "fix_state": "Affected", "package_name": "java-11-openjdk-portable", "product_name": "Red Hat build of OpenJDK 11 ELS"}, {"cpe": "cpe:/a:redhat:openjdk_els:11", "fix_state": "Affected", "package_name": "java-11-openjdk-windows", "product_name": "Red Hat build of OpenJDK 11 ELS"}, {"cpe": "cpe:/a:redhat:openjdk:17", "fix_state": "Affected", "package_name": "java-17-openjdk-portable", "product_name": "Red Hat build of OpenJDK 17"}, {"cpe": "cpe:/a:redhat:openjdk:17", "fix_state": "Affected", "package_name": "java-17-openjdk-windows", "product_name": "Red Hat build of OpenJDK 17"}, {"cpe": "cpe:/a:redhat:openjdk:1.8", "fix_state": "Affected", "package_name": "java-1.8.0-openjdk-portable", "product_name": "Red Hat build of OpenJDK 1.8"}, {"cpe": "cpe:/a:redhat:openjdk:1.8", "fix_state": "Affected", "package_name": "java-1.8.0-openjdk-windows", "product_name": "Red Hat build of OpenJDK 1.8"}, {"cpe": "cpe:/a:redhat:openjdk:21", "fix_state": "Affected", "package_name": "java-21-openjdk-portable", "product_name": "Red Hat build of OpenJDK 21"}, {"cpe": "cpe:/a:redhat:openjdk:21", "fix_state": "Affected", "package_name": "java-21-openjdk-windows", "product_name": "Red Hat build of OpenJDK 21"}, {"cpe": "cpe:/a:redhat:openjdk:25", "fix_state": "Affected", "package_name": "java-25-openjdk-portable", "product_name": "Red Hat build of OpenJDK 25"}, {"cpe": "cpe:/a:redhat:openjdk:25", "fix_state": "Affected", "package_name": "java-25-openjdk-windows", "product_name": "Red Hat build of OpenJDK 25"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "java-21-ibm-semeru-certified-jdk", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "java-21-openjdk", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "java-25-openjdk", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "java-1.6.0-openjdk", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "java-1.7.0-openjdk", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "java-1.8.0-openjdk", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "java-1.6.0-openjdk", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "java-1.7.0-openjdk", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "java-1.8.0-openjdk", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "java-17-openjdk", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "java-1.8.0-ibm", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "java-1.8.0-openjdk", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "java-21-openjdk", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "java-17-openjdk", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "java-1.8.0-openjdk", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "java-21-openjdk", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "java-25-openjdk", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "java-21-openjdk", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "java-21-openjdk-portable", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "java-25-openjdk", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "java-25-openjdk-portable", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-04-21T20:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-22016\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-22016\nhttps://www.oracle.com/security-alerts/cpuapr2026.html#AppendixJAVA"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "21.3.17"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "graalvm", "vendor": "oracle"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "21.3.17"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Oracle GraalVM Enterprise Edition", "source": "cna", "vendor": "Oracle Corporation"}, "product": "graalvm_enterprise_edition", "vendor": "oracle"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "17.0.18"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "21.0.10"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "graalvm_for_jdk", "vendor": "oracle"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "8u481"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "8u481-b50"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "8u481-perf"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "11.0.30"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "17.0.18"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "21.0.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "25.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "26"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Oracle Java SE", "source": "cna", "vendor": "Oracle Corporation"}, "product": "java_se", "vendor": "oracle"}], "analysis": {"en": {"generated_at": "2026-04-29T00:24:21.935332+00:00", "value": {"mitigation_remediation": ["Apply the vendor patches for all affected Oracle Java SE and GraalVM releases as announced in the Oracle CPU April 2026 advisory", "If patching cannot be performed immediately, disable external entity processing in the JAXP parser configuration to prevent XML-based attacks", "Restrict network access to services that expose JAXP endpoints to trusted hosts only"], "summary": {"action": "Apply patch", "impact": "Unauthorized access to confidential data"}, "threat_synthesis": {"affected_systems": "The affected products are Oracle Java SE across multiple release streams (8u481, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26, 8u481-b50, 8u481-perf) and Oracle GraalVM distributions (GraalVM for JDK 17.0.18 and 21.0.10, and GraalVM Enterprise Edition 21.3.17). These versions are listed in the CVE advisory and correspond to the CPE strings provided.", "description_and_impact": "This vulnerability resides in the JAXP component of Oracle Java SE and GraalVM products. It permits an unauthenticated attacker with network access to exploit the APIs exposed over various protocols, such as web services, to gain unauthorized access to critical data. The primary impact is confidentiality compromise, as the attacker can read sensitive data stored within the affected applications or the underlying systems.", "risk_and_exploitability": "The CVSS 3.1 base score of 7.5 reflects a high risk to confidentiality, with an attack vector of network and no authentication required. The EPSS score of < 1% indicates a very low but nonzero exploitation probability, and the vulnerability is not currently in CISA KEV, but the combination of network reachability and lack of authentication still makes exploitation technically possible. An attacker can construct crafted XML payloads or use other XML-oriented protocols to trigger the JAXP component, potentially exposing sensitive data."}}}}, "created": "2026-04-22T03:00:06.748638+00:00", "updated": "2026-04-29T00:30:16.127589+00:00", "vendors": ["oracle", "oracle$PRODUCT$graalvm", "oracle$PRODUCT$graalvm_enterprise_edition", "oracle$PRODUCT$graalvm_for_jdk", "oracle$PRODUCT$java_se"]}