CVE-2026-22007: 
Amazon Corretto JDK vulnerability analysis and mitigation

CVE-2026-22007 is a low-severity information disclosure vulnerability in the Security component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition, disclosed as part of Oracle's April 2026 Critical Patch Update. The vulnerability stems from a weakness in 3DES salt generation when cryptographic keys are repeated. Affected versions include Oracle Java SE 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, and 26; Oracle GraalVM for JDK 17.0.18 and 21.0.10; and Oracle GraalVM Enterprise Edition 21.3.17. It carries a CVSS v3.1 base score of 2.9 (Low) (Oracle CPU Apr 2026, GitHub Advisory).

The vulnerability is classified under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Specifically, the Red Hat bug tracker describes the root cause as a weakness in 3DES salt generation when cryptographic keys are reused, which can allow an attacker to infer protected data (Red Hat Bugzilla). Exploitation requires local logon access to the infrastructure where the affected Java runtime executes, and the attack complexity is rated High, meaning specific conditions must be met. The vulnerability can also be triggered via APIs in the Security component — including through web services that supply data to those APIs — and applies to sandboxed Java Web Start applications or applets loading untrusted code (Oracle CPU Apr 2026).

Successful exploitation results in unauthorized read access to a subset of data accessible by the affected Oracle Java SE, GraalVM for JDK, or GraalVM Enterprise Edition instance. The impact is limited to confidentiality — there is no integrity or availability impact. Given the local attack vector, high complexity, and narrow data exposure, the practical risk is low; however, environments relying on 3DES-based cryptographic operations with repeated keys may expose sensitive cryptographic material (Oracle CPU Apr 2026, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity and requirement for local infrastructure access further limit practical exploitability.

Oracle has released fixed versions addressing this vulnerability: Oracle Java SE 8u491, 11.0.31, 17.0.19, 21.0.11, and 25.0.3 (Red Hat Bugzilla). Upstream OpenJDK patches are available for versions 8, 11, 17, 21, and 25 via the respective OpenJDK repositories. Downstream vendors including Red Hat (RHSA-2026:22139, RHSA-2026:22328), IBM (Semeru Runtime, SDK, and various product advisories), SUSE, Debian, Ubuntu, and Amazon Linux have also released updated packages. Organizations should apply the April 2026 Critical Patch Update or the corresponding vendor-specific patches promptly, and restrict local access to systems running affected Java runtimes where immediate patching is not feasible (Oracle CPU Apr 2026, IBM Advisory).

The vulnerability was reported to Oracle by Ken Pyle, as credited in the April 2026 Critical Patch Update advisory (Oracle CPU Apr 2026). Azul published a blog post highlighting the Java security update cycle and encouraging prompt patching of Java runtimes. Coverage has been primarily limited to routine patch advisory tracking across Linux distribution security channels (Red Hat, Debian, SUSE, Ubuntu, openSUSE, AlmaLinux, Rocky Linux, Amazon Linux) and vendor security bulletins from IBM. No significant independent researcher commentary or social media discussion has been identified, consistent with the vulnerability's low severity rating.