CVE-2026-22007

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22007", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "state": "PUBLISHED", "assignerShortName": "oracle", "dateReserved": "2026-01-05T18:07:34.726Z", "datePublished": "2026-04-21T20:35:04.885Z", "dateUpdated": "2026-04-22T14:05:28.424Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2026-04-21T20:35:04.885Z"}, "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data."}]}], "affected": [{"vendor": "Oracle Corporation", "product": "Oracle Java SE", "versions": [{"version": "8u481", "status": "affected"}, {"version": "8u481-b50", "status": "affected"}, {"version": "8u481-perf", "status": "affected"}, {"version": "11.0.30", "status": "affected"}, {"version": "17.0.18", "status": "affected"}, {"version": "21.0.10", "status": "affected"}, {"version": "25.0.2", "status": "affected"}, {"version": "26", "status": "affected"}]}, {"vendor": "Oracle Corporation", "product": "Oracle GraalVM for JDK", "versions": [{"version": "17.0.18", "status": "affected"}, {"version": "21.0.10", "status": "affected"}]}, {"vendor": "Oracle Corporation", "product": "Oracle GraalVM Enterprise Edition", "versions": [{"version": "21.3.17", "status": "affected"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:8u481:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*", "versionStartIncluding": "8u481", "versionEndIncluding": "b50"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:8u481:*:*:*:enterprise_performance:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:11.0.30:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:17.0.18:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:21.0.10:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:25.0.2:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:java_se:26:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.18:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.10:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:graalvm:21.3.17:*:*:*:enterprise:*:*:*"}]}]}], "descriptions": [{"lang": "en-US", "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 2.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."}], "references": [{"url": "https://www.oracle.com/security-alerts/cpuapr2026.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 2.9, "baseSeverity": "LOW"}}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T14:05:16.229810Z", "id": "CVE-2026-22007", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T14:05:28.424Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22007", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T14:05:16.229810Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T14:05:25.565Z"}}], "cna": {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.9, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Oracle Corporation", "product": "Oracle Java SE", "versions": [{"status": "affected", "version": "8u481"}, {"status": "affected", "version": "8u481-b50"}, {"status": "affected", "version": "8u481-perf"}, {"status": "affected", "version": "11.0.30"}, {"status": "affected", "version": "17.0.18"}, {"status": "affected", "version": "21.0.10"}, {"status": "affected", "version": "25.0.2"}, {"status": "affected", "version": "26"}]}, {"vendor": "Oracle Corporation", "product": "Oracle GraalVM for JDK", "versions": [{"status": "affected", "version": "17.0.18"}, {"status": "affected", "version": "21.0.10"}]}, {"vendor": "Oracle Corporation", "product": "Oracle GraalVM Enterprise Edition", "versions": [{"status": "affected", "version": "21.3.17"}]}], "references": [{"url": "https://www.oracle.com/security-alerts/cpuapr2026.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en-US", "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 2.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data."}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:java_se:8u481:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "b50", "versionStartIncluding": "8u481"}, {"criteria": "cpe:2.3:a:oracle:java_se:8u481:*:*:*:enterprise_performance:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:java_se:11.0.30:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:java_se:17.0.18:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:java_se:21.0.10:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:java_se:25.0.2:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:java_se:26:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.18:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.10:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:graalvm:21.3.17:*:*:*:enterprise:*:*:*", "vulnerable": true}], "operator": "OR"}]}], "providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2026-04-21T20:35:04.885Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22007", "state": "PUBLISHED", "dateUpdated": "2026-04-22T14:05:28.424Z", "dateReserved": "2026-01-05T18:07:34.726Z", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "datePublished": "2026-04-21T20:35:04.885Z", "assignerShortName": "oracle"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Oracle Java SE", "vendor": "Oracle Corporation", "versions": [{"status": "affected", "version": "8u481"}, {"status": "affected", "version": "8u481-b50"}, {"status": "affected", "version": "8u481-perf"}, {"status": "affected", "version": "11.0.30"}, {"status": "affected", "version": "17.0.18"}, {"status": "affected", "version": "21.0.10"}, {"status": "affected", "version": "25.0.2"}, {"status": "affected", "version": "26"}]}, {"product": "Oracle GraalVM for JDK", "vendor": "Oracle Corporation", "versions": [{"status": "affected", "version": "17.0.18"}, {"status": "affected", "version": "21.0.10"}]}, {"product": "Oracle GraalVM Enterprise Edition", "vendor": "Oracle Corporation", "versions": [{"status": "affected", "version": "21.3.17"}]}], "source": "secalert_us@oracle.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:graalvm:21.3.17:*:*:*:enterprise:*:*:*", "matchCriteriaId": "A03023A6-9A6F-40EE-A9BE-5A8EDC1EEE94", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.18:*:*:*:*:*:*:*", "matchCriteriaId": "55B50BFF-7A24-4603-826D-60D80DBF748E", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.10:*:*:*:*:*:*:*", "matchCriteriaId": "A6B951D6-6031-4169-962B-6127A6D7FB6D", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:jre:1.8.0:update481:*:*:-:*:*:*", "matchCriteriaId": "2D3819BA-3DBD-4E7A-AB5D-E550263CBBF7", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jre:1.8.0:update481:*:*:enterprise_performance_pack:*:*:*", "matchCriteriaId": "91BD9F52-958E-4D64-A00D-F183530364CA", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jre:1.8.0:update481_b50:*:*:-:*:*:*", "matchCriteriaId": "CE5DA635-B7B3-4E1A-9B1C-5973A615B728", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jre:11.0.30:*:*:*:*:*:*:*", "matchCriteriaId": "37F85D83-BD75-4BE3-9CE6-8429ECCD8FF6", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jre:17.0.18:*:*:*:*:*:*:*", "matchCriteriaId": "A8589FE8-7CD5-44FA-9325-913D3311DE53", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jre:21.0.10:*:*:*:*:*:*:*", "matchCriteriaId": "B46BFB77-EBC7-45CB-868A-4204DFB8B94F", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jre:25.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "27E53593-6BF0-4F3F-942A-B7A5E97012F7", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jre:26:*:*:*:*:*:*:*", "matchCriteriaId": "726A7677-AC58-42AA-809A-38AA8069160A", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update481:*:*:-:*:*:*", "matchCriteriaId": "34640E60-3068-4AAA-BE14-7AF11694E213", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update481:*:*:enterprise_performance_pack:*:*:*", "matchCriteriaId": "600DC6D9-0F42-42D8-81AF-4B7744A71F09", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update481_b50:*:*:-:*:*:*", "matchCriteriaId": "EC91B23D-3BAF-4E1E-9A9D-EE5CCA1ACAE3", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jdk:11.0.30:*:*:*:*:*:*:*", "matchCriteriaId": "A7099EA6-7B33-41F5-9760-BF4617C19C7B", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jdk:17.0.18:*:*:*:*:*:*:*", "matchCriteriaId": "ABF7AF16-10C8-4544-8D33-A10C869D8132", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jdk:21.0.10:*:*:*:*:*:*:*", "matchCriteriaId": "54B529F3-E3EB-4214-B6D4-372EC1ECEE92", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jdk:25.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "DC1E16C1-62E1-4325-AD55-61C5F7584DD0", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jdk:26:*:*:*:*:*:*:*", "matchCriteriaId": "1D96D602-E003-4D50-9D57-3436E04478D4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 2.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."}, {"lang": "es", "value": "Vulnerabilidad en el producto Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition de Oracle Java SE (componente: Security). Las versiones compatibles afectadas son Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 y 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Una vulnerabilidad dif\u00edcil de explotar permite a un atacante no autenticado con inicio de sesi\u00f3n en la infraestructura donde se ejecuta Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition comprometer Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso de lectura no autorizado a un subconjunto de datos accesibles de Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Nota: Esta vulnerabilidad puede ser explotada utilizando APIs en el Componente especificado, por ejemplo, a trav\u00e9s de un servicio web que suministra datos a las APIs. Esta vulnerabilidad tambi\u00e9n se aplica a implementaciones de Java, t\u00edpicamente en clientes que ejecutan aplicaciones Java Web Start en sandbox o applets Java en sandbox, que cargan y ejecutan c\u00f3digo no confiable (por ejemplo, c\u00f3digo que proviene de internet) y dependen del sandbox de Java para la seguridad. Puntuaci\u00f3n Base CVSS 3.1 de 2.9 (Impactos en la Confidencialidad). Vector CVSS: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."}], "id": "CVE-2026-22007", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.4, "impactScore": 1.4, "source": "secalert_us@oracle.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22007", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T14:05:16.229810Z", "version": "2.0.3"}}]}, "published": "2026-04-21T21:16:26.440", "references": [{"source": "secalert_us@oracle.com", "tags": ["Vendor Advisory"], "url": "https://www.oracle.com/security-alerts/cpuapr2026.html"}], "sourceIdentifier": "secalert_us@oracle.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "openjdk: OpenJDK: Enhance crypto algorithm support (Oracle CPU 2026-04)", "id": "2460038", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460038"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.9", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-327", "details": ["No description is available for this CVE."], "name": "CVE-2026-22007", "package_state": [{"cpe": "cpe:/a:redhat:openjdk_els:11", "fix_state": "Affected", "package_name": "java-11-openjdk", "product_name": "Red Hat build of OpenJDK 11 ELS"}, {"cpe": "cpe:/a:redhat:openjdk_els:11", "fix_state": "Affected", "package_name": "java-11-openjdk-portable", "product_name": "Red Hat build of OpenJDK 11 ELS"}, {"cpe": "cpe:/a:redhat:openjdk_els:11", "fix_state": "Affected", "package_name": "java-11-openjdk-windows", "product_name": "Red Hat build of OpenJDK 11 ELS"}, {"cpe": "cpe:/a:redhat:openjdk:17", "fix_state": "Affected", "package_name": "java-17-openjdk-portable", "product_name": "Red Hat build of OpenJDK 17"}, {"cpe": "cpe:/a:redhat:openjdk:17", "fix_state": "Affected", "package_name": "java-17-openjdk-windows", "product_name": "Red Hat build of OpenJDK 17"}, {"cpe": "cpe:/a:redhat:openjdk:1.8", "fix_state": "Affected", "package_name": "java-1.8.0-openjdk-portable", "product_name": "Red Hat build of OpenJDK 1.8"}, {"cpe": "cpe:/a:redhat:openjdk:1.8", "fix_state": "Affected", "package_name": "java-1.8.0-openjdk-windows", "product_name": "Red Hat build of OpenJDK 1.8"}, {"cpe": "cpe:/a:redhat:openjdk:21", "fix_state": "Affected", "package_name": "java-21-openjdk-portable", "product_name": "Red Hat build of OpenJDK 21"}, {"cpe": "cpe:/a:redhat:openjdk:21", "fix_state": "Affected", "package_name": "java-21-openjdk-windows", "product_name": "Red Hat build of OpenJDK 21"}, {"cpe": "cpe:/a:redhat:openjdk:25", "fix_state": "Affected", "package_name": "java-25-openjdk-portable", "product_name": "Red Hat build of OpenJDK 25"}, {"cpe": "cpe:/a:redhat:openjdk:25", "fix_state": "Affected", "package_name": "java-25-openjdk-windows", "product_name": "Red Hat build of OpenJDK 25"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "java-21-ibm-semeru-certified-jdk", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "java-21-openjdk", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "java-25-openjdk", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "java-1.6.0-openjdk", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "java-1.7.0-openjdk", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "java-1.8.0-openjdk", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "java-1.6.0-openjdk", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "java-1.7.0-openjdk", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "java-1.8.0-openjdk", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "java-17-openjdk", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "java-1.8.0-ibm", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "java-1.8.0-openjdk", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "java-21-openjdk", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "java-17-openjdk", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "java-1.8.0-openjdk", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "java-21-openjdk", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "java-25-openjdk", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "java-21-openjdk", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "java-21-openjdk-portable", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "java-25-openjdk", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "java-25-openjdk-portable", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-04-21T20:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-22007\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-22007\nhttps://www.oracle.com/security-alerts/cpuapr2026.html#AppendixJAVA"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "21.3.17"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "graalvm", "vendor": "oracle"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "21.3.17"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Oracle GraalVM Enterprise Edition", "source": "cna", "vendor": "Oracle Corporation"}, "product": "graalvm_enterprise_edition", "vendor": "oracle"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "17.0.18"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "21.0.10"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Oracle GraalVM for JDK", "source": "cna", "vendor": "Oracle Corporation"}, "product": "graalvm_for_jdk", "vendor": "oracle"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "8u481"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "8u481-b50"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "8u481-perf"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "11.0.30"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "17.0.18"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "21.0.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "25.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "26"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Oracle Java SE", "source": "cna", "vendor": "Oracle Corporation"}, "product": "java_se", "vendor": "oracle"}], "analysis": {"en": {"generated_at": "2026-04-22T15:05:57.307175+00:00", "value": {"mitigation_remediation": ["Apply the official Oracle patch or update for the affected Java SE, GraalVM for JDK, and GraalVM Enterprise Edition releases listed in the April\u202f2026 CPU", "Limit exposure of APIs that return sensitive data to trusted clients only, ensuring that untrusted calls cannot reach the vulnerable component", "If feasible, isolate the Java runtime in a segregated environment and restrict network access to services relying on the affected component"], "summary": {"action": "Patch", "impact": "Confidentiality Compromise"}, "threat_synthesis": {"affected_systems": "Affected versions include Oracle Java SE 8u481 (including the 8u481\u2011b50 and 8u481\u2011perf builds), 11.0.30, 17.0.18, 21.0.10, 25.0.2, and 26; Oracle GraalVM for JDK 17.0.18 and 21.0.10; and Oracle GraalVM Enterprise Edition 21.3.17. These products are listed in Oracle\u2019s April\u202f2026 Critical Patch Update.", "description_and_impact": "A flaw in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows a local attacker with access to the infrastructure where the software runs to read data that should be protected. The vulnerability resides in the handling of certain APIs, such as those that return data via a web service. When successfully exploited, an attacker can obtain unauthorized read access to a subset of data exposed by the affected component. The CVSS 3.1 Base Score of 2.9 reflects a low\u2011level confidentiality impact rather than full code execution or denial of service.", "risk_and_exploitability": "The CVSS vector (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates that the attack requires local presence or access to the environment where the software is executed, and the exploit is considered difficult to employ. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of exploitation remains uncertain. Nevertheless, the potential for data exposure warrants timely remediation through the vendor\u2019s update, particularly for systems handling sensitive information."}}}}, "created": "2026-04-22T01:45:05.391379+00:00", "updated": "2026-04-22T15:15:16.420019+00:00", "vendors": ["oracle", "oracle$PRODUCT$graalvm", "oracle$PRODUCT$graalvm_enterprise_edition", "oracle$PRODUCT$graalvm_for_jdk", "oracle$PRODUCT$java_se"]}