Networking Vulnerability in Oracle Java SE and GraalVM Products
CVE-2026-61308

6.8MEDIUM

Key Information:

Vendor

Oracle
Status
Oracle Java Se, Oracle Graalvm For Jdk, Oracle Graalvm Enterprise Edition
Vendor
CVE Published:
18 August 2026

What is CVE-2026-61308?

A vulnerability in Oracle's Java SE and GraalVM products allows unauthenticated attackers with network access to potentially compromise the affected systems. This flaw, rooted in the Networking component, impacts critical versions of Oracle Java SE and its GraalVM variants. Attackers can exploit this vulnerability through APIs in the Networking component, posing serious risks for unauthorized access to sensitive data. The vulnerability's reach may extend to other products relying on Java deployments, particularly in environments utilizing sandboxed applications that execute untrusted code from the internet. This emphasizes the need for prompt patching and security measures to mitigate risks.

Affected Version(s)

Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition Oracle Java SE:8u501

Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition Oracle Java SE:11.0.32

Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition Oracle Java SE:17.0.20

References

https://www.oracle.com/security-alerts/cspuaug2026.html
vendor-advisory

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.