CVE-2026-46968: Oracle Java SE JSSE… (EIP-generated)

Record summary

CVE-2026-46968 has a selected CVSS score of 5.9 (medium).

Description

Vulnerability in Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

Description source: GitHub Advisory

Exploitation context

CISA SSVC decision

ExploitationNone

AutomatableNo

Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 22, 2026 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
Oracle Java SE Browse Oracle Corporation / Oracle Java SE	CVE List	8u491	affected
		8u491-perf	affected
		11.0.31	affected
		17.0.19	affected
		21.0.11	affected
		25.0.3	affected
		26.0.1	affected

References

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2026-46968

Oracle AdvisoryVendor advisory

https://www.oracle.com/security-alerts/cpujul2026.html