CVE-2026-34282

highPriorität · verfolgen · 0EPSS 0.006 · 50. PerzentilDEEUFRJPRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.64% (50th) EPSS

CVSS 7.5 · high

Is it mine?

156 products

Prüfe deine Angriffsfläche

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · secalert_us@oracle.com USAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HsecondaryAusnutzbarkeit 3.9 · Auswirkung 3.6

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-400USCWE-400USCWE-835US

betroffene Produkte (156)

Betroffene Produkte und Versionsbereiche.

Amazon Linux 2alle Versionencert_bundDEcpe:/o:amazon:linux_2:-
Azul Zulualle Versionencert_bundDEcpe:/a:azul:zulu:-
Debian Linuxalle Versionencert_bundDEcpe:/o:debian:debian_linux:-
Dell Avamaralle Versionencert_bundDEcpe:/a:dell:avamar:-
Dell NetWorkeralle Versionencert_bundDEcpe:/a:dell:networker:-
Gentoo Linuxalle Versionencert_bundDEcpe:/o:gentoo:linux:-
HCL BigFix Compliancealle Versionencert_bundDEcpe:/a:hcltech:bigfix:compliance
HCL BigFix IVR 4.3alle Versionencert_bundDEcpe:/a:hcltech:bigfix:ivr_4.3
IBM App Connect Enterprisealle Versionencert_bundDEcpe:/a:ibm:app_connect_enterprise:-
IBM App Connect Enterprise 12.0.1.0-12.0.12.25alle Versionencert_bundDEcpe:/a:ibm:app_connect_enterprise:12.0.1.0_-_12.0.12.25
IBM App Connect Enterprise 13.0.1.0-13.0.7.1alle Versionencert_bundDEcpe:/a:ibm:app_connect_enterprise:13.0.1.0_-_13.0.7.1
IBM Business Automation Workflowalle Versionencert_bundDEcpe:/a:ibm:business_automation_workflow:-
IBM Content Manager 8.7alle Versionencert_bundDEcpe:/a:ibm:content_manager:8.7
IBM DB2alle Versionencert_bundDEcpe:/a:ibm:db2:-
IBM InfoSphere Information Serveralle Versionencert_bundDEcpe:/a:ibm:infosphere_information_server:-
IBM Java 7.1.0.0-7.1.5.29alle Versionencert_bundDEcpe:/a:ibm:jre:7.1.0.0_-_7.1.5.29
IBM Java 8.0.0.0-8.0.8.60alle Versionencert_bundDEcpe:/a:ibm:jre:8.0.0.0_-_8.0.8.60
IBM MQalle Versionencert_bundDEcpe:/a:ibm:mq:-
IBM MQ Operatoralle Versionencert_bundDEcpe:/a:ibm:mq:operator
IBM Power Hardware Management Consolealle Versionencert_bundDEcpe:/a:ibm:hardware_management_console:-

20 von 156 angezeigt

Advisories (9)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2026-1201Oracle Java SE: Mehrere SchwachstellenDeutsch2026-04-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Java SE ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2026-1687IBM License Metric Tool: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffDeutsch2026-05-26csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM License Metric Tool ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
BIT-java-2026-342822026-05-06vendor · osvUS
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
BIT-java-min-2026-342822026-05-06vendor · osvUS
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
BIT-jre-2026-342822026-05-08vendor · osvUS
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CERTFR-2026-AVI-1378Multiples vulnérabilités dans les produits IBMFrançais2026-10-23vendor · certfrFR
CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
JVNDB-2026-016982JVN iPedia advisory JVNDB-2026-0169822026-09-11vendor · jvndbJP
JVNDB-2026-016983JVN iPedia advisory JVNDB-2026-0169832026-05-27vendor · jvndbJP

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

CNNVD-202604-3951 cnnvd
EUVD-2026-24362 enisa_euvd
BDU:2026-06671 fstec_bdu
BIT-java-2026-34282osv
BIT-java-min-2026-34282osv
BIT-jre-2026-34282osv

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv cert_bund certfr jvndb NVD CVE.org MITRE

veröffentlicht 2026-04-21geändert 2026-10-26

Referenzen (21)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan