Description
Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Published: 2026-10-20
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Title Oracle Java SE Compiler API Data Modification and Disclosure Vulnerability openjdk: Improve C2 loop transformations (Oracle CPU 2026-10)
Weaknesses CWE-733
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 21 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Oracle oracle Java Se
Vendors & Products Oracle oracle Java Se

Wed, 21 Oct 2026 07:15:00 +0000

Type Values Removed Values Added
Title Oracle Java SE Compiler API Data Modification and Disclosure Vulnerability
Weaknesses CWE-200
CWE-639

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
First Time appeared Oracle
Oracle java Se
CPEs cpe:2.3:a:oracle:java_se:21.0.12.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:25.0.4.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:27:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle java Se
References
Metrics cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Oracle Java Se Oracle Java Se
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:23:37.939Z

Reserved: 2026-08-31T15:40:57.355Z

Link: CVE-2026-83378

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:19:54.040

Modified: 2026-10-21T18:44:19.627

Link: CVE-2026-83378

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-20T21:23:37Z

Links: CVE-2026-83378 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T14:15:06Z

Weaknesses