CVE-2026-46968

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1 Oracle GraalVM for JDK versions 17.0.19, 21.0.11 Oracle GraalVM Enterprise Edition version 21.3.18

Description An issue in the JSSE component allows an unauthenticated attacker with network access via TLS to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all accessible data. This issue is triggered by supplying data to APIs within the specified component, such as through a web service, without the use of Untrusted Java Web Start applications or Untrusted Java applets.

Recommendations Update Oracle Java SE to versions 8u491, 11.0.32, 17.0.20, 21.0.12, 25.0.4, or 26.0.2. Update Oracle GraalVM for JDK to versions 17.0.20 or 21.0.12. Update Oracle GraalVM Enterprise Edition to a version newer than 21.3.18.