CVE-2026-22008

lowpriority · track · 10EPSS 0.002 · 11 %ileexploit · PoCDEEUFRRUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

0.21% (11th) EPSS

CVSS 3.7 · low

Is it mine?

86 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

Vulnerability in Oracle Java SE (component: Libraries). The supported version that is affected is Oracle Java SE: 25.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

cvss

Technical severity, 0–10. One row per scoring source.

3.7

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.13.7lowAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.13.7lowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · ENISA EU

v3.13.7lowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · secalert_us@oracle.com USexploitability 2.2 · impact 1.4

v3.13.5lowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:Psecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-250USCWE-250US

exploits (1)

Public proof-of-concept and weaponised exploit code.

George0Papasotiriou/CVE-2026-22008-AWS-Lambda-Layer-Injection-via-Shared-Layer-ARNGeorge0Papasotiriou/CVE-2026-22008-AWS-Lambda-Layer-Injection-via-Shared-Layer-ARNPoC · poc_in_github

affected products (86)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Azul Zuluall versionscert_bundDEcpe:/a:azul:zulu:-
Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Dell Avamarall versionscert_bundDEcpe:/a:dell:avamar:-
Dell NetWorkerall versionscert_bundDEcpe:/a:dell:networker:-
Gentoo Linuxall versionscert_bundDEcpe:/o:gentoo:linux:-
HCL BigFix Complianceall versionscert_bundDEcpe:/a:hcltech:bigfix:compliance
HCL BigFix IVR 4.3all versionscert_bundDEcpe:/a:hcltech:bigfix:ivr_4.3
IBM App Connect Enterpriseall versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:-
IBM App Connect Enterprise 12.0.1.0-12.0.12.25all versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:12.0.1.0_-_12.0.12.25
IBM App Connect Enterprise 13.0.1.0-13.0.7.1all versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:13.0.1.0_-_13.0.7.1
IBM Business Automation Workflowall versionscert_bundDEcpe:/a:ibm:business_automation_workflow:-
IBM Content Manager 8.7all versionscert_bundDEcpe:/a:ibm:content_manager:8.7
IBM DB2all versionscert_bundDEcpe:/a:ibm:db2:-
IBM InfoSphere Information Serverall versionscert_bundDEcpe:/a:ibm:infosphere_information_server:-
IBM Java 7.1.0.0-7.1.5.29all versionscert_bundDEcpe:/a:ibm:jre:7.1.0.0_-_7.1.5.29
IBM Java 8.0.0.0-8.0.8.60all versionscert_bundDEcpe:/a:ibm:jre:8.0.0.0_-_8.0.8.60
IBM MQall versionscert_bundDEcpe:/a:ibm:mq:-
IBM MQ Operatorall versionscert_bundDEcpe:/a:ibm:mq:operator
IBM Power Hardware Management Consoleall versionscert_bundDEcpe:/a:ibm:hardware_management_console:-

showing 20 of 86

advisories (6)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-1201Oracle Java SE: Mehrere SchwachstellenDeutsch2026-04-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Java SE ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2026-1687IBM License Metric Tool: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffDeutsch2026-05-26csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM License Metric Tool ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
BIT-java-2026-220082026-05-06vendor · osvUS
Vulnerability in Oracle Java SE (component: Libraries). The supported version that is affected is Oracle Java SE: 25.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
BIT-java-min-2026-220082026-05-06vendor · osvUS
Vulnerability in Oracle Java SE (component: Libraries). The supported version that is affected is Oracle Java SE: 25.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
BIT-jre-2026-220082026-05-08vendor · osvUS
Vulnerability in Oracle Java SE (component: Libraries). The supported version that is affected is Oracle Java SE: 25.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
CERTFR-2026-AVI-1378Multiples vulnérabilités dans les produits IBMFrançais2026-10-23vendor · certfrFR

also known as (6)

Other names and identifiers for this entity.

CNNVD-202604-3982 cnnvd
EUVD-2026-24313 enisa_euvd
BDU:2026-06609 fstec_bdu
BIT-java-2026-22008osv
BIT-java-min-2026-22008osv
BIT-jre-2026-22008osv

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund certfr NVD CVE.org MITRE

published 2026-04-21modified 2026-10-26

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan