CVE-2026-21925: Oracle Java SE and GraalVM data manipulation in RMI

CVE-2026-21925 · Severity: medium · CVSS 4.8 · Published 2026-01-20

Oracle Java SE and GraalVM are widely used platforms for running enterprise applications and web services. A vulnerability in the Remote Method Invocation (RMI) component could allow an attacker to remotely access or modify certain application data. While difficult to exploit, this flaw could lead to unauthorized data manipulation or information disclosure in environments that process untrusted data or rely on the Java sandbox for security.

Technologies: Oracle GraalVM Enterprise Edition, Oracle Graalvm For Jdk, Oracle Java SE, Siemens SIMATIC CN 4100. Vendors: Oracle, Siemens.

Quick answers

Is CVE-2026-21925 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-21925 being exploited in the wild.
How severe is CVE-2026-21925?
Medium severity, with a CVSS score of 4.8, published 20 January 2026.
Which products and versions are affected?
Oracle GraalVM Enterprise Edition 21.3.16; Oracle Graalvm For Jdk 17.0.17, 21.0.9; Oracle Java SE 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Siemens SIMATIC CN 4100 All versions < V5.0.
Is there a fix for CVE-2026-21925?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-21925 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-21925?
Check whether you run Oracle GraalVM Enterprise Edition, Oracle Graalvm For Jdk, Oracle Java SE or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the Remote Method Invocation (RMI) component of Oracle Java SE and GraalVM. The flaw is characterized by Oracle as difficult to exploit but allows an unauthenticated attacker with network access via multiple protocols to compromise the environment. Successful exploitation can result in unauthorized read, update, insert, or delete access to a subset of accessible data. The vulnerability is particularly relevant to Java deployments that load untrusted code (such as sandboxed applets or Web Start applications) or web services that supply data to RMI APIs. Siemens has also identified this as an inherited vulnerability in their SIMATIC CN 4100 communication nodes. Oracle addressed these issues in the January 2026 Critical Patch Update.

Affected products

  • Oracle Java SE 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1
  • Oracle GraalVM for JDK 17.0.17, 21.0.9
  • Oracle GraalVM Enterprise Edition 21.3.16
  • Siemens SIMATIC CN 4100 All versions < V5.0

Timeline

  • 2026-01-20: disclosed: Initial disclosure by Oracle
  • 2026-01-20: advisory: NVD published CVE-2026-21925
  • 2026-05-12: advisory: Siemens published advisory SSA-032379 noting impact on SIMATIC CN 4100

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.