PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46917 Oracle Corporation CVE debrief

The CVE-2026-46917 vulnerability affects the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products, specifically in the JSSE component. This vulnerability allows an unauthenticated attacker with network access via TLS to compromise these products, potentially leading to a partial denial of service (partial DOS). The affected versions include Oracle Java SE: 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. The vulnerability has a CVSS 3.1 Base Score of 5.3, indicating a medium severity level. Users of these products should apply security updates to prevent partial denial of service attacks. The CVE record was published on 2026-07-21T22:17:01.810Z and has not been modified since then.

Vendor
Oracle Corporation
Product
Oracle Java SE
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-08-03
Advisory published
2026-07-21
Advisory updated
2026-08-03

Who should care

Users of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition should apply security updates to prevent partial denial of service attacks. This includes operators, platform administrators, vulnerability management teams, and security teams responsible for these products. They should review official advisories, assess their exposure, and plan mitigations accordingly.

Technical summary

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). The vulnerability allows an unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks can result in unauthorized ability to cause a partial denial of service (partial DOS). Affected products include Oracle Java SE: 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18.

Defensive priority

Apply security updates for Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition to prevent partial denial of service attacks.

Recommended defensive actions

  • Apply security updates for Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition
  • Restrict access to APIs in the JSSE component
  • Monitor for suspicious activity
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability affects Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. Supported versions that are affected include Oracle Java SE: 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. The vulnerability allows an unauthenticated attacker with network access via TLS to compromise these products. Successful attacks can result in unauthorized ability to cause a partial denial of service (partial DOS). Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46917 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46917

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46917 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46917

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.