CVE-2026-22013

CVE-2026-22013 is a vulnerability in the Java GSSAPI (JGSS) component affecting Oracle Java SE versions 8u481 through 26, Oracle GraalVM for JDK (versions 17.0.18 and 21.0.10), and Oracle GraalVM Enterprise Edition 21.3.17. The vulnerability specifically targets client-side Java deployments such as Java Web Start applications and applets that execute untrusted code from the internet. The vulnerability has a CVSS 3.1 base score of 5.3 (Medium severity) with a network attack vector requiring high complexity and user interaction. An unauthenticated attacker with network access could potentially compromise confidentiality and gain unauthorized access to critical data, though no integrity or availability impacts are expected. The high complexity and requirement for user involvement significantly limit exploitability compared to other vulnerabilities. This vulnerability is not currently being actively exploited in the wild, with an EPSS score of 0.0004 indicating very low probability of exploitation. No public exploit code is available, and the vulnerability has not been included in the CISA Known Exploited Vulnerabilities catalog. Community attention remains minimal given the stringent prerequisites and low technical severity rating, suggesting organizations can prioritize patching based on their reliance on vulnerable client-side Java deployments.