SECURITYCRITICALCVE-2026-114820

CVE-2026-114820: Critical Oracle Java SE and GraalVM JSSE Vulnerability

Oracle Java SE, GraalVM for JDK and GraalVM Enterprise are affected by a CVSS 9.1 flaw in the JSSE component across current Java release trains.

Dylan H.

Security Team

October 25, 2026
1 min read
CVE-2026-114820: Critical Oracle Java SE and GraalVM JSSE Vulnerability

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • Oracle Java SE 8u511-b32, 8u511-perf-b32
  • Oracle Java SE 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2
  • Oracle Java SE 25.0.5.0.2, 27.0.1.0.2
  • Oracle GraalVM for JDK, GraalVM Enterprise Edition

Executive Summary

CVE-2026-114820 is a critical (CVSS 9.1) vulnerability in the JSSE (Java Secure Socket Extension) component of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition. It was published to NVD on 2026-10-24.

Vulnerability Details

FieldValue
CVE IDCVE-2026-114820
CVSS Score9.1 (Critical)
ComponentJSSE
VendorOracle

Affected Versions

Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2 and 27.0.1.0.2. The matching Oracle GraalVM for JDK and GraalVM Enterprise Edition builds are also affected; consult the Oracle advisory for the exact list.

Remediation

  1. Apply the latest Oracle Critical Patch Update for your Java release train.
  2. Inventory Java runtimes, including those bundled inside applications, containers and appliances, since these are often missed.
  3. Prioritize internet-facing services that terminate or initiate TLS using JSSE.
  4. Restart services after patching so the updated runtime is loaded.

References