Vulnerabilities ›

CVE-2026-21932

High

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java

                    Published: Jan 20, 2026                      ·  Modified: Feb 28, 2026                      ·  Source: NVD                

CVSS v3

7.4

🔗 NVD Official

📄 Description (English)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).

🤖 AI Executive Summary

A high-severity vulnerability (CVSS 7.4) in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition affects multiple versions through the AWT and JavaFX components. The vulnerability allows unauthenticated network attackers to compromise data integrity through malicious Java Web Start applications or applets, requiring user interaction. While primarily impacting client-side Java deployments, successful exploitation can significantly affect downstream systems and data.

📄 Description (Arabic)

🤖 AI Intelligence Analysis Analyzed: May 4, 2026 20:23

🇸🇦 Saudi Arabia Impact Assessment

Saudi organizations using Java-based applications face significant risk, particularly: (1) Banking sector (SAMA-regulated institutions) relying on Java for client applications and trading platforms; (2) Government agencies (NCA oversight) using Java Web Start for administrative tools; (3) Telecommunications (STC, Mobily) deploying Java-based customer portals; (4) Healthcare institutions using Java applets for medical records access; (5) Energy sector (ARAMCO, SEC) with Java-based operational systems. The scope change (S:C) indicates potential lateral movement to critical backend systems. Risk is elevated in organizations with high user populations accessing untrusted content or third-party Java applications.

🏢 Affected Saudi Sectors

Banking and Financial Services Government and Public Administration Telecommunications Healthcare Energy and Utilities Education Insurance Retail and E-commerce

🎯 MITRE ATT&CK Techniques

T1566.002 - Phishing: Spearphishing Link (malicious Java Web Start URLs) T1204.001 - User Execution: Malicious Link (user clicks Java applet/Web Start) T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain (compromised Java apps) T1559.001 - Inter-Process Communication: Component Object Model (Java sandbox escape) T1485 - Data Destruction (unauthorized modification/deletion of data) T1565.001 - Data Manipulation: Stored Data Manipulation (integrity impact)

⚖️ Saudi Risk Score (AI)

7.8

/ 10.0

🔧 Remediation Steps (English)

IMMEDIATE ACTIONS:

1. Inventory all Java deployments: identify systems running affected versions (Java 8u471, 11.0.29, 17.0.17, 21.0.9, 25.0.1, GraalVM 17.0.17/21.0.9/21.3.16)

2. Prioritize patching client-side deployments (Java Web Start, applets) over server-side trusted code

3. Disable Java Web Start and applets in browsers if not business-critical

4. Apply Oracle's latest security patches immediately upon availability



PATCHING GUIDANCE:

- Update to patched versions: Java 8u481+, 11.0.30+, 17.0.18+, 21.0.10+, 25.0.2+

- GraalVM users: update to versions released in January 2025 security bulletin

- Test patches in non-production environments first

- Schedule maintenance windows for production systems



COMPENSATING CONTROLS (if patching delayed):

- Restrict Java Web Start application sources to trusted internal repositories

- Implement network segmentation to limit lateral movement from compromised clients

- Deploy application whitelisting to prevent unauthorized Java execution

- Monitor for suspicious Java process behavior (file modifications, network connections)

- Disable AWT/JavaFX rendering in sandboxed environments where possible



DETECTION RULES:

- Monitor for java.exe/javaw.exe processes with suspicious parent processes

- Alert on file modifications in user temp directories during Java execution

- Track Java Web Start cache access patterns (typically %APPDATA%\Sun\Java\Deployment)

- Monitor network connections from Java processes to non-whitelisted destinations

- Log all Java applet/Web Start application launches with source URLs

🔧 خطوات المعالجة (العربية)

الإجراءات الفورية:

1. حصر جميع نشر Java: تحديد الأنظمة التي تعمل بالإصدارات المتأثرة (Java 8u471، 11.0.29، 17.0.17، 21.0.9، 25.0.1، GraalVM 17.0.17/21.0.9/21.3.16)

2. إعطاء الأولوية لتصحيح نشر جانب العميل (Java Web Start، applets) على الكود الموثوق من جانب الخادم

3. تعطيل Java Web Start و applets في المتصفحات إذا لم تكن حرجة للعمل

4. تطبيق أحدث تصحيحات الأمان من Oracle فور توفرها



إرشادات التصحيح:

- التحديث إلى الإصدارات المصححة: Java 8u481+، 11.0.30+، 17.0.18+، 21.0.10+، 25.0.2+

- مستخدمو GraalVM: التحديث إلى الإصدارات المُصدرة في نشرة الأمان لشهر يناير 2025

- اختبار التصحيحات في بيئات غير الإنتاج أولاً

- جدولة نوافذ الصيانة لأنظمة الإنتاج



الضوابط البديلة (إذا تأخر التصحيح):

- تقييد مصادر تطبيقات Java Web Start إلى مستودعات داخلية موثوقة

- تنفيذ تقسيم الشبكة لتحديد الحركة الجانبية من العملاء المخترقين

- نشر القائمة البيضاء للتطبيقات لمنع تنفيذ Java غير المصرح به

- مراقبة سلوك عملية Java المريب (تعديلات الملفات، الاتصالات الشبكية)

- تعطيل عرض AWT/JavaFX في البيئات المحدودة حيث أمكن



قواعد الكشف:

- مراقبة عمليات java.exe/javaw.exe مع عمليات أب مريبة

- تنبيه على تعديلات الملفات في دلائل temp للمستخدم أثناء تنفيذ Java

- تتبع أنماط وصول ذاكرة التخزين المؤقت Java Web Start (عادة %APPDATA%\Sun\Java\Deployment)

- مراقبة الاتصالات الشبكية من عمليات Java إلى وجهات غير موثوقة

- تسجيل جميع عمليات إطلاق applet/Web Start مع عناوين URL المصدر

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

ECC 2024 A.5.1.1 - Information Security Policies (Java security policies) ECC 2024 A.12.6.1 - Management of Technical Vulnerabilities (patch management) ECC 2024 A.14.2.1 - Secure Development Policy (secure coding for Java) ECC 2024 A.12.3.1 - Segregation of Networks (network segmentation for Java clients)

🔵 SAMA CSF

SAMA CSF ID.RA-1 - Asset Management (inventory Java deployments) SAMA CSF PR.IP-12 - Security Awareness and Training (Java security risks) SAMA CSF DE.CM-8 - Vulnerability Scans (detect affected Java versions) SAMA CSF RS.MI-2 - Incidents are mitigated (patch management procedures)

🟡 ISO 27001:2022

ISO 27001:2022 A.12.3.1 - Segregation of networks ISO 27001:2022 A.12.6.1 - Management of technical vulnerabilities and exposures ISO 27001:2022 A.14.2.1 - Secure development policy and procedures ISO 27001:2022 A.5.23 - Information security for supplier relationships

🟣 PCI DSS v4.0.1

PCI DSS 6.2 - Ensure security patches are installed within one month of release PCI DSS 11.2 - Run automated vulnerability scans quarterly and after changes PCI DSS 2.4 - Document and implement security configuration standards

🔗 References & Sources 1

🔗

https://www.oracle.com/security-alerts/cpujan2026.html

secalert_us@oracle.com

Vendor Advisory

📦 Affected Products / CPE 17 entries

oracle:graalvm:21.3.16

oracle:graalvm_for_jdk:17.0.17

oracle:graalvm_for_jdk:21.0.9

oracle:jdk:1.8.0

oracle:jdk:11.0.29

oracle:jdk:17.0.17

oracle:jdk:21.0.9

oracle:jdk:25.0.1

oracle:jre:1.8.0

oracle:jre:11.0.29

oracle:jre:17.0.17

oracle:jre:21.0.9

oracle:jre:25.0.1

📊 CVSS Score

7.4

/ 10.0 — High

📊 CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Attack VectorN — None / Network

Attack ComplexityL — Low / Local

Privileges RequiredN — None / Network

User InteractionR — Required

ScopeC — Changed

ConfidentialityN — None / Network

IntegrityH — High

AvailabilityN — None / Network

📋 Quick Facts

Severity High

CVSS Score7.4

EPSS0.03%

Exploit No

Patch ✓ Yes

Published 2026-01-20

Source Feed nvd

🇸🇦 Saudi Risk Score

7.8

/ 10.0 — Saudi Risk

Priority: HIGH

🏢 Vendor Advisories

🔗 https://www.oracle.com/security-alerts/cpujan2026.html

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

💬 Comments

Loading comments

CVE-2026-21932

💬 Comments

Introduce Yourself

Sign In Required