CVE-2026-21932

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX)

High · published January 20, 2026

CVSS v3.1
7.4
EPSS
1%
Percentile
43.7
In the wild
Unconfirmed
What it is

⚠️ An unfriendly invite is all it takes! This high-severity vulnerability in Oracle Java SE and GraalVM lets attackers exploit network access and compromise your setup—just with a bit of human interaction! 🔥 Think of it like a restaurant where a sneaky diner gets someone at another table to deliver their special ingredient to the chef without anyone noticing. Once that happens, the chef can be tricked into cooking up a dish that’s not safe to eat! If exploited, this vulnerability could allow unauthorized creation, deletion, or modification of critical data across all accessible platforms in Oracle Java SE and GraalVM. Imagine the chaos if an attacker could tamper with your data, leaving you scrambling to recover from a potentially devastating breach!

Put simply

Think of it like a restaurant where a sneaky diner gets someone at another table to deliver their special ingredient to the chef without anyone noticing. Once that happens, the chef can be tricked into cooking up a dish that’s not safe to eat! This vulnerability resides in the AWT and JavaFX components of Oracle Java SE and GraalVM, allowing unauthenticated network attackers to manipulate data by leveraging sandboxed Java applets or Web Start applications that load untrusted code.

What to do

If exploited, this vulnerability could allow unauthorized creation, deletion, or modification of critical data across all accessible platforms in Oracle Java SE and GraalVM. Imagine the chaos if an attacker could tamper with your data, leaving you scrambling to recover from a potentially devastating breach! Patch your Oracle Java SE and GraalVM installations to the latest versions—check for updates to 8u471, 11.0.29, and 21.3.16 to ensure you're protected. Additionally, restrict the use of untrusted code in sandboxed applications wherever possible! You've got this! With a little action, you can lock down your systems and keep those vulnerabilities at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00525 · 43.7th percentile
Published
2026-01-20T21:56Z
EPSS history
Timeline
  • 20 JAN 21:56Z
    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX)
    cvelistv5