Oracle Java SE JSSE unauthenticated TLS compromise
Critical flaw in Oracle Java SE's JSSE TLS library lets unauthenticated network attackers compromise confidentiality and integrity on all supported versions.
- Vendor
- Oracle
- Product
- Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; GraalVM for JDK 17.0.21, 21.0.13; GraalVM Enterprise Edition 21.3.20
- CVSS
- 9.1
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
Is CVE-2026-114820 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-114820 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-25 snapshot. That can change quickly; check the write-up below for the latest reporting.
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-25. Full cross-catalog view: /kev-comparison
CVE-2026-114820 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-114820 is a critical vulnerability in JSSE, the SSL/TLS library bundled with Oracle Java SE. All currently supported Java SE release trains are affected: 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1. Oracle GraalVM for JDK 17 and 21, and GraalVM Enterprise Edition 21.3.20, are also in scope.
An unauthenticated attacker with network access can exploit this flaw via any protocol JSSE processes. No credentials and no user interaction are required. Successful exploitation results in unauthorized read and write access to data protected by the affected TLS connections (CVSS C:H/I:H). Availability is not impacted.
The attack surface includes web services that expose JSSE APIs, covering most Java server software doing TLS, as well as Java clients running sandboxed applications that load untrusted code.
Apply Oracle’s October 2026 Critical Patch Update. Consult Oracle’s advisory for patched version numbers per release train. Products that bundle their own JRE (WebLogic, etc.) require a separate vendor update check.
Other Oracle CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-21962 Oracle WebLogic/HTTP Server unauthenticated data access via HTTPwrite-up | [ CRITICAL ] | 10.0 | 73.2% | |
| CVE-2026-46817 Oracle E-Business Suite Payments improper privilege management (unauth RCE)write-up | [ CRITICAL ] | 9.8 | 0.8% | |
| CVE-2026-35273 Oracle PeopleSoft PeopleTools missing authentication allows unauthenticated takeoverransomware usewrite-up | [ CRITICAL ] | 9.8 | 96.7% | |
| CVE-2024-21182 Oracle WebLogic Server Unspecified Vulnerability | [ HIGH ] | 7.5 | 74.2% | |
| CVE-2025-61757 Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability | [ CRITICAL ] | 9.8 | 88.6% | |
| CVE-2025-61884 Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerabilityransomware use | [ HIGH ] | 7.5 | 95.9% | |
| CVE-2025-61882 Oracle E-Business Suite BI Publisher Integration unauth RCEransomware usewrite-up | [ CRITICAL ] | 9.8 | 99.7% | |
| CVE-2024-20953 Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability | [ HIGH ] | 8.8 | 3.9% |
