Oracle Java JSSE Flaw Hits All Supported Versions, CVSS 9.1

Oracle’s October 2026 Critical Patch Update includes a fix you should prioritize: CVE-2026-114820, a CVSS 9.1 critical flaw in JSSE, the SSL/TLS implementation embedded in every Oracle Java SE release. No authentication required, no user interaction, low attack complexity, and it crosses both confidentiality and integrity in a single shot.

What’s Vulnerable

Every currently supported Oracle Java SE version is affected:

• Java SE 8u511-b32 and 8u511-perf-b32
• Java SE 11.0.33
• Java SE 17.0.21
• Java SE 21.0.13
• Java SE 25.0.5
• Java SE 27.0.1

Oracle GraalVM for JDK 17.0.21 and 21.0.13 are also in scope, as is GraalVM Enterprise Edition 21.3.20. That’s the full currently-supported product line, end to end.

What It Does

CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N reads plainly: a remote attacker with network access, no credentials, and no special knowledge can exploit this against any Java application that uses JSSE for TLS connections. Successful exploitation gives that attacker read and write access to data those TLS sessions are supposed to be protecting. Availability is untouched, but C:H/I:H means the TLS protection it relies on is effectively gone.

The attack path runs through web services that expose JSSE APIs, which covers the majority of Java-based server software doing TLS. Oracle also notes the flaw affects Java clients running sandboxed Java Web Start applications or applets that load untrusted code, expanding the surface beyond server deployments.

CISA’s SSVC analysis rates this “automatable” with “total” technical impact. It is not in the CISA KEV catalog as of October 25, 2026. That window won’t stay open indefinitely.

What to Do

Apply the October 2026 Critical Patch Update. Oracle’s security advisory has the patched version numbers for each release train, including GraalVM builds. Don’t guess at version suffixes from partial information; pull the actual CPU and verify.

If you’re running Java inside a product runtime (WebLogic, JBoss, Tomcat, any vendor-bundled JRE), check the vendor’s advisory path separately. Many distribute their own JRE and issue CPU coverage under their own schedule. WebLogic, for example, has had its own Java-level patches in recent Oracle CPUs; the October 2026 WebLogic update covers the pattern.

Oracle’s track record on Java SE CVEs in this year’s CPUs has been consistent: a critical unauth RCE in Oracle EBS Payments made CISA’s KEV catalog in July. JSSE flaws have an even wider blast radius because Java SE sits below the application layer in nearly every enterprise Java stack. Patch it like what it is: foundational runtime, all branches, no exceptions.