PT-2026-34077 · Oracle · Java Se+1

Published 2026-01-01 · Updated 2026-05-29 · CVE-2026-22008

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle Java SE version 25.0.1

Description An issue in the Libraries component allows an unauthenticated attacker with network access via multiple protocols to compromise the system. This can lead to unauthorized update, insert, or delete access to certain accessible data. This affects deployments that load and run untrusted code, such as sandboxed Java Web Start applications or sandboxed Java applets, which rely on the Java sandbox for security.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-250

Related Identifiers

ALSA-2026:9693

BDU:2026-06609

BIT-JAVA-2026-22008

BIT-JAVA-MIN-2026-22008

BIT-JRE-2026-22008

CVE-2026-22008

OPENSUSE-SU-2026:10639-1

OPENSUSE-SU-2026:10893-1

RHSA-2026:7286

RHSA-2026:7311

RHSA-2026:9693

USN-8334-1

USN-8339-1

USN-8341-1

Affected Products

Java Platform

Java Se

References · 61

• https://osv.dev/vulnerability/BIT-jre-2026-22008 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8339-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8339-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-22008 · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2026.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22008 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22007 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8341-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22021 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10639-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-22008 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22008 · Security Note
• https://errata.almalinux.org/9/ALSA-2026-9693.html · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-22008 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22016 · Vendor Advisory