CVE-2022-21449

mediumpriority · attend · 57EPSS 0.772 · 100 %ileexploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

12 exploits · PoC

Likely / severe?

77.2% (100th) EPSS

CVSS 5 · medium

Is it mine?

43 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 5–9.8

v2.05mediumAV:N/AC:L/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 10 · impact 2.9

v2.05mediumAV:N/AC:L/Au:N/C:N/I:P/A:N/E:Hsecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · secalert_us@oracle.com USexploitability 3.9 · impact 3.6

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-347US

exploits (12)

Public proof-of-concept and weaponised exploit code.

AlexanderZinoni/CVE-2022-21449AlexanderZinoni/CVE-2022-21449PoC · poc_in_github
Damok82/SignCheckerTest tool to demonstrate the vulnerability of CVE-2022-21449PoC · poc_in_github
HeyMrSalt/AIS3-2024-Project-D5TeamReappear-CVE-2022-21449-TLS-PoCPoC · poc_in_github
Skipper7718/CVE-2022-21449-showcaseSkipper7718/CVE-2022-21449-showcasePoC · poc_in_github
davwwwx/CVE-2022-21449repo showcasing generating "psychic signatures for java" implemented in a nodejs environment 😅PoC · poc_in_github
fevra-dev/ClaimJumperProfessional JWT security testing toolkit. Analyze, crack, forge, and exploit JSON Web Tokens with 15+ vulnerability checks, 100k secret wordlist, and CVE-specific attacks (CVE-2022-21449, CVE-2018-0114).PoC · poc_in_github

affected products (43)

Products and version ranges known to be affected.

Xerox FreeFlow Print Server 7all versionscert_bundDEcpe:/a:xerox:freeflow_print_server:7
Xerox FreeFlow Print Server 9all versionscert_bundDEcpe:/a:xerox:freeflow_print_server:9
Xerox FreeFlow Print Server v9all versionscert_bundDEcpe:/a:xerox:freeflow_print_server:v9
Oracle Corporation Java SE JDK and JRE≤ Oracle Java SE:18enisa_euvdEU
Oracle Corporation Java SE JDK and JRE≤ Oracle GraalVM Enterprise Edition:21.3.1enisa_euvdEU
Oracle Corporation Java SE JDK and JRE≤ Oracle GraalVM Enterprise Edition:22.0.0.2enisa_euvdEU
Oracle Corporation Java SE JDK and JRE≤ Oracle Java SE:17.0.2enisa_euvdEU
Axiom JDK Axiom AxiomJDK≤ 17.0.2.0.1fstec_bduRU
Axiom JDK Axiom AxiomJDK≤ 17.0.3fstec_bduRU
IBM Corp. IBM Cloud Object Storage Systems3.16.0.121 → 3.16.7.55fstec_bduRU
Oracle Corp. GraalVM Enterprise Edition≤ 21.3.1fstec_bduRU
Oracle Corp. GraalVM Enterprise Edition≤ 22.0.0.2fstec_bduRU
Oracle Corp. Java SE≤ 17.0.2fstec_bduRU
Oracle Corp. Java SE≤ 18fstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 8fstec_bduRU
Red Hat Inc. Red Hat build of OpenJDK≤ 17fstec_bduRU
azul zulu= 15.38nvdUScpe:2.3:a:azul:zulu:*:*:*:*:*:*:*:*
azul zulu= 17.32nvdUScpe:2.3:a:azul:zulu:*:*:*:*:*:*:*:*
azul zulu= 18.28nvdUScpe:2.3:a:azul:zulu:*:*:*:*:*:*:*:*
debian debian linux= 10.0nvdUScpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*

showing 20 of 43

advisories (5)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2022-0200Oracle Java SE und OpenJDK: Mehrere SchwachstellenDeutsch2022-04-19csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Java SE und OpenJDK ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2022-1335Xerox FreeFlow Print Server: Mehrere SchwachstellenDeutsch2022-09-07csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität des Systems zu gefährden.
BIT-java-2022-214492026-05-06vendor · osvUS
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
BIT-java-min-2022-214492026-05-06vendor · osvUS
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
BIT-jre-2022-214492026-05-08vendor · osvUS
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

also known as (7)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund nvd NVD CVE.org MITRE

published 2022-04-19modified 2026-06-17

references (75)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan