CVE-2026-70906

HighCVSS 7.5

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.44%

37th percentile - higher than 37% of all known CVEs

Summary

Vulnerability in Oracle Java SE (component: 2D) versions 25.0.4 and 26.0.2. An unauthenticated attacker with network access via multiple protocols can cause a hang or frequently repeatable crash (complete DoS) of Java SE. The vulnerability can be exploited via APIs in the component, e.g., through a web service supplying data to APIs, and also applies to Java deployments running sandboxed applications.

Risk Assessment

The risk includes unavailability of Java applications, potentially affecting systems dependent on Java SE, especially in sandboxed client environments.

Recommendation

Apply Oracle patches for Java SE versions 25.0.4 and 26.0.2, and limit trust in untrusted code running in the sandbox.

Original NVD description (English source)

Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 25.0.4 and 26.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).