Improper input validation in Oracle GraalVM Enterprise Edition - CVE-2026-22003

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU126760

Improper input validation in Oracle GraalVM Enterprise Edition - CVE-2026-22003

Published: April 22, 2026


Vulnerability identifier: #VU126760
CSH Severity: Low
CVSS v4: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-22003
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local authenticated user to damange or delete data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A local authenticated user can exploit this vulnerability to damange or delete data.


Affected software

Oracle GraalVM Enterprise Edition
Oracle Java SE
EMC Data Protection Advisor
NetWorker Runtime Environment (NRE)

How to mitigate CVE-2026-22003

Install updates from vendor's website.

EMC Data Protection Advisor - addressed in versions 19.12 SP1, 19.12 SP2
NetWorker Runtime Environment (NRE) - update to 17.0.5

External References

Related Security Bulletins