/
← Voltar ao feed
high exploit público

CERT-FR: Multiple vulnerabilities in Oracle Java SE, GraalVM and JavaFX fixed in Oracle CPU October 2026

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 21:00 · coletado há 4 horas

CERT-FR advisory CERTFR-2026-AVI-1350 (21 October 2026) relays the Oracle Critical Patch Update of 20 October 2026 (cpuoct2026) for Oracle Java SE, Oracle GraalVM and Oracle JavaFX. The bulletin covers well over 100 CVE identifiers. According to CERT-FR, some of the flaws allow remote arbitrary code execution, remote denial of service, loss of data confidentiality and integrity, and security policy bypass. The advisory does not report active exploitation, nor does it detail per-CVE severity or attack vectors.

Entenda a falha

A vulnerabilidade

Oracle's October 2026 Critical Patch Update (cpuoct2026, 20 October 2026), relayed by CERT-FR, covers well over 100 CVEs in Oracle Java SE, GraalVM and JavaFX. CERT-FR says some of them allow remote arbitrary code execution, remote denial of service, loss of data confidentiality and integrity, and security policy bypass. The advisory gives no per-CVE severity, component or attack vector (network reach, authentication, user interaction), so none can be stated here. Affected versions: Java SE 8u503 (and 8u503-perf), 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 26.0.2 and 27; GraalVM for JDK 17.0.20.1 and 21.0.12.1; GraalVM Enterprise 21.3.19.1.1; JavaFX 21.0.12 and 25.0.4. The list also includes older IDs such as CVE-2024-4367 and CVE-2024-47778. Fixes are in the Oracle bulletin.

Como funciona

The articles do not describe how any of these flaws work internally, so the vulnerable process cannot be traced step by step. CERT-FR only lists the impact categories: remote code execution, remote denial of service, confidentiality and integrity breaches, and security policy bypass. Which input reaches which component, and where it goes wrong, is in the Oracle bulletin and CVE records, not in the material available here.

Por que é vulnerável

The articles do not state root causes for any of the CVEs. The advisory only says multiple vulnerabilities were found and points to the vendor bulletin for the patches. What each fix changes is not described.

Como foi descoberta

The articles do not say who found the individual flaws or how. They only report that Oracle published the Critical Patch Update cpuoct2026 on 20 October 2026 and that CERT-FR relayed it as advisory CERTFR-2026-AVI-1350 on 21 October 2026. The advisory does not report active exploitation.

Explicação gerada por IA a partir da matéria e dos artigos, em 23/10/2026 12:18.

Exploit público

Há código de exploração publicado no Exploit-DB para CVE-2024-4367. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52273 ↗ · remoto · multiple · pub. 22/04/2025 não verificado

    Firefox ESR 115.11 - PDF.js Arbitrary JavaScript execution

    This script generates a malicious PDF that abuses CVE-2024-4367, a missing type check in how PDF.js handles the font matrix of an embedded font, letting attacker-chosen JavaScript be injected into code the viewer builds to draw glyphs. The attacker needs no credentials, only to get the victim to open the file in a vulnerable Firefox or Firefox ESR (before the May 2024 fixes) or in an app bundling an old PDF.js. The outcome is arbitrary JavaScript running in the PDF viewer's context. It is a working proof-of-concept generator that embeds a supplied script; it is unverified.

    CVE-2024-4367 · autor: Milad karimi · explicação gerada por IA

Detalhes técnicos

  • Impact categories listed: remote code execution, remote denial of service, confidentiality and integrity breaches, security policy bypass.
  • Affected versions: Java SE 8u503 (and 8u503-perf), 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 26.0.2 and 27; GraalVM for JDK 17.0.20.1 and 21.0.12.1; GraalVM Enterprise Edition 21.3.19.1.1; JavaFX 21.0.12 and 25.0.4.
  • Includes older identifiers such as CVE-2024-4367 and CVE-2024-47778 alongside the 2026 CVEs.

Remediação

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 20/10/2026 21:00 · coletado 23/10 12:01 primeiro registro

    CERT-FR: Multiple vulnerabilities in Oracle Java SE, GraalVM and JavaFX fixed in Oracle CPU October 2026

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1350 (21 October 2026) relays the Oracle Critical Patch Update of 20 October 2026 (cpuoct2026) for Oracle Java SE, Oracle GraalVM and Oracle JavaFX. The bulletin covers well over 100 CVE identifiers. According to CERT-FR, some of the flaws allow remote arbitrary code execution, remote denial of service, loss of data confidentiality and integrity, and security policy bypass. The advisory does not report active exploitation, nor does it detail per-CVE severity or attack vectors.

    Technical Details

    • Impact categories listed: remote code execution, remote denial of service, confidentiality and integrity breaches, security policy bypass.
    • Affected versions: Java SE 8u503 (and 8u503-perf), 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 26.0.2 and 27; GraalVM for JDK 17.0.20.1 and 21.0.12.1; GraalVM Enterprise Edition 21.3.19.1.1; JavaFX 21.0.12 and 25.0.4.
    • Includes older identifiers such as CVE-2024-4367 and CVE-2024-47778 alongside the 2026 CVEs.

    Remediation