Oracle Java SE: critical vulnerability

Oracle Java SE

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2;…

Do this now

Inventory your Java SE and GraalVM installs and watch for Oracle's fix to the JSSE flaw.

Still cooking for Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition.

First seen: 24 Oct 2026
Last update: 24 Oct 2026, 20:17 UTC
Identifiers: CVE-2026-114820
CVSS: 9.1
Source: news
On the menu as: Java

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Oracle Java SE: critical vulnerability
Severity: critical. Patch status: fix status unknown.
Affected: Oracle Java SE
Ids: CVE-2026-114820

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2;…

## Steps
1. Search the repo, its CI and infra config for Oracle Java SE. If present, report the version in use and whether it's affected.
2. There is no fix yet. Until one ships: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2;…

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-114820") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-114820 https://www.oracle.com/security-alerts/alert-cve-2026-114820.html
https://pwned.coffee/i/vulnerability-in-the-oracle-java-se-oracle-graalvm-for-j-cve-2026-114820

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Oracle Java SE 8u511-b32 to 27.0.1.0.2 (6 lines) fix not named in the CVE record: see vendor advisory CVE record (CNA)
Oracle GraalVM for JDK = 21.0.13.0.2 fix not named in the CVE record: see vendor advisory CVE record (CNA)
Oracle GraalVM for JDK = 17.0.21.0.2 fix not named in the CVE record: see vendor advisory CVE record (CNA)
Oracle GraalVM Enterprise Edition = 21.3.20.0.2 fix not named in the CVE record: see vendor advisory CVE record (CNA)
Score: CVSS 9.1 (critical). CVSS 3.1 9.1 (CNA oracle) for CVE-2026-114820
Last checked: 24 Oct 2026, 20:17 UTC

Product	Affected	Fixed in	Source
Oracle Java SE	8u511-b32 to 27.0.1.0.2 (6 lines)	fix not named in the CVE record: see vendor advisory	CVE record (CNA)
Oracle GraalVM for JDK	= 21.0.13.0.2	fix not named in the CVE record: see vendor advisory	CVE record (CNA)
Oracle GraalVM for JDK	= 17.0.21.0.2	fix not named in the CVE record: see vendor advisory	CVE record (CNA)
Oracle GraalVM Enterprise Edition	= 21.3.20.0.2	fix not named in the CVE record: see vendor advisory	CVE record (CNA)

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Totalone very hot coffee