Oracle patches dozens of Java flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
NCSC-NL advisory covers over 50 Oracle Java SE, JavaFX and GraalVM vulnerabilities enabling denial of service and unauthorized data access via network attacks.
The Dutch National Cyber Security Centre (NCSC-NL) published advisory NCSC-2026-0449 detailing a large batch of vulnerabilities patched by Oracle across Java SE, JavaFX, and GraalVM Enterprise Edition. The flaws span multiple weakness classes including divide-by-zero errors, use-after-free conditions, type confusion, and incorrect authorization issues. Affected components include the compiler, networking stack, JAXP, JDBC, RMI, ImageIO, the Lightweight HTTP Server, and CORBA implementations.
According to the advisory, unauthenticated network attackers can exploit these issues via exposed APIs or sandboxed Java applications, in some cases requiring user interaction. Successful exploitation can cause denial of service (crashes or system hangs when processing untrusted code in sandboxed environments), unauthorized read/write access to data, and in limited cases, unauthorized data disclosure. The highest-severity issue (CVE-2026-46470) carries a CVSS v3 score of 9.1, with several others scoring above 7.0.
No evidence of active exploitation is cited in the advisory. Oracle has released updates addressing all listed CVEs; organizations running Oracle Java SE, JavaFX, or GraalVM EE should prioritize patching based on exposure of Java-based network services, use of sandboxed code execution, and the CVSS scores listed, particularly for CVE-2026-46470, CVE-2026-6732, CVE-2026-43660, and CVE-2026-91484.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0449.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,932 reports from 143 sources, 508 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs