Ubuntu fixes OpenJDK 21 flaws that can expose or alter data
Remote attackers could modify data via Security and JSSE issues; one Compiler flaw needs no authentication.
48
CVE-2026-83378
Improper access control in Oracle Java SE Compiler
- CVSS 3.1
- 4.8 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Oracle Java SE’s Compiler component improperly controls access when data is supplied to its APIs, for example through a web service. An unauthenticated attacker with network access over multiple protocols can trigger it without user interaction; exploitation is difficult. Success allows limited unauthorized read and update, insert, or delete of some Java SE data. It is not reachable through untrusted Java Web Start applications or untrusted applets. Affected builds are 21.0.12.1, 25.0.4.1, and 27.
What to do: Apply Oracle’s update for CVE-2026-83378. Oracle has not listed a fixed version.
| Product | Affected |
|---|---|
| Oracle Java SE | 21.0.12.1, 25.0.4.1 and 27 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
- Weakness
- CWE-284
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N