CVE-2026-22016

OVERVIEW CVE-2026-22016 is a vulnerability in the JAXP component of Oracle Java SE and related products, affecting multiple versions including Java SE 8u481 through 26, GraalVM for JDK 17.0.18 and 21.0.10, and GraalVM Enterprise Edition 21.3.17. The vulnerability allows unauthenticated attackers to gain unauthorized access to critical data through network-accessible APIs, and can be exploited via web services, Java Web Start applications, or sandboxed applets. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector requiring low complexity and no user interaction or privileges. The attack results in high confidentiality impact, potentially exposing all accessible data within affected Java environments, though it does not enable unauthorized modification or denial of service. The vulnerability is easily exploitable due to its minimal prerequisites for attack execution. EXPLOITATION STATUS This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and shows no evidence of active exploitation in the wild. The EPSS score of 0.00033 indicates minimal real-world exploitation probability at present, and community attention remains low with the vulnerability marked as inactive on threat tracking systems. However, organizations should prioritize patching given the high CVSS score and ease of exploitation once widely understood.