# Oracle patches dozens of Java flaws

Published: 2026-10-22 · Severity: elevated
Canonical: https://vorant.io/reports/6c57c995-b5d7-5728-9c0b-5cbdfa18a3e1/oracle-patches-dozens-of-java-flaws

> NCSC-NL advisory covers over 50 Oracle Java SE, JavaFX and GraalVM vulnerabilities enabling denial of service and unauthorized data access via network attacks.

The Dutch National Cyber Security Centre (NCSC-NL) published advisory NCSC-2026-0449 detailing a large batch of vulnerabilities patched by Oracle across Java SE, JavaFX, and GraalVM Enterprise Edition. The flaws span multiple weakness classes including divide-by-zero errors, use-after-free conditions, type confusion, and incorrect authorization issues. Affected components include the compiler, networking stack, JAXP, JDBC, RMI, ImageIO, the Lightweight HTTP Server, and CORBA implementations.

According to the advisory, unauthenticated network attackers can exploit these issues via exposed APIs or sandboxed Java applications, in some cases requiring user interaction. Successful exploitation can cause denial of service (crashes or system hangs when processing untrusted code in sandboxed environments), unauthorized read/write access to data, and in limited cases, unauthorized data disclosure. The highest-severity issue (CVE-2026-46470) carries a CVSS v3 score of 9.1, with several others scoring above 7.0.

No evidence of active exploitation is cited in the advisory. Oracle has released updates addressing all listed CVEs; organizations running Oracle Java SE, JavaFX, or GraalVM EE should prioritize patching based on exposure of Java-based network services, use of sandboxed code execution, and the CVSS scores listed, particularly for CVE-2026-46470, CVE-2026-6732, CVE-2026-43660, and CVE-2026-91484.

## Mentioned in this report

- Vulnerabilities: CVE-2026-101516, CVE-2026-101737, CVE-2026-43660, CVE-2026-46470, CVE-2026-6732, CVE-2026-83374, CVE-2026-83378, CVE-2026-83380, CVE-2026-83381, CVE-2026-83387, CVE-2026-83395, CVE-2026-83400, CVE-2026-87290, CVE-2026-87291, CVE-2026-87293, CVE-2026-87294, CVE-2026-91332, CVE-2026-91373, CVE-2026-91374, CVE-2026-91375, CVE-2026-91379, CVE-2026-91382, CVE-2026-91385, CVE-2026-91394, CVE-2026-91395, CVE-2026-91396, CVE-2026-91398, CVE-2026-91410, CVE-2026-91411, CVE-2026-91415, CVE-2026-91417, CVE-2026-91418, CVE-2026-91451, CVE-2026-91452, CVE-2026-91453, CVE-2026-91462, CVE-2026-91463, CVE-2026-91464, CVE-2026-91484, CVE-2026-91487

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0449.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6c57c995-b5d7-5728-9c0b-5cbdfa18a3e1/oracle-patches-dozens-of-java-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup