{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Oracle. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp" } }, "lang": "en", "publisher": { "category": "vendor", "name": "Oracle", "namespace": "https://www.oracle.com" }, "references": [ { "summary": "URL to html version of Advisory", "url": "https://www.oracle.com/security-alerts/alert-cve-2026-114820.html" }, { "category": "self", "summary": "Canonical URL for this CSAF document.", "url": "https://www.oracle.com/docs/tech/security-alerts/cve-2026-114820csaf.json" } ], "title": "Oracle Security Alert for CVE-2026-114820 - Oracle CSAF", "tracking": { "current_release_date": "2026-10-30T16:00:00-07:00", "id": "cve-2026-114820csaf", "initial_release_date": "2026-10-24T13:00:00-07:00", "revision_history": [ { "date": "2026-04-24T13:00:00-07:00", "number": "1", "summary": "Initial Release." }, { "date": "2026-10-30T16:00:00-07:00", "number": "2", "summary": "Added Oracle Autonomous Health Framework, Oracle Database Serve, Oracle Global Lifecycle Management OPatch, Oracle Hospitality Cruise Shipboard Property Management (SPMS)" } ], "status": "final", "version": "2" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": ">=26.3|<=26.10", "product": { "name": "Oracle Autonomous Health Framework Version 26.3-26.10", "product_id": "P-14634V-26.3-26.10", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:autonomous_health_framework:26.3-26.10:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "Oracle Autonomous Health Framework" } ], "category": "product_family", "name": "Oracle Autonomous Health Framework" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": ">=19.3|<=19.32", "product": { "name": "Oracle Database Server(RDBMS (Java)) Version 19.3-19.32", "product_id": "P-5(RDBMS-Java)V-19.3-19.32", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:database_-_rdbms:19.3-19.32:*:*:*:*:*:*:*" } } }, { "category": "product_version_range", "name": ">=21.3|<=21.23", "product": { "name": "Oracle Database Server(RDBMS (Java)) Version 21.3-21.23", "product_id": "P-5(RDBMS-Java)V-21.3-21.23", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:database_-_rdbms:21.3-21.23:*:*:*:*:*:*:*" } } }, { "category": "product_version_range", "name": ">=23.4.0|<=23.26.3", "product": { "name": "Oracle Database Server(RDBMS (Java)) Version 23.4.0-23.26.3", "product_id": "P-5(RDBMS-Java)V-23.4.0-23.26.3", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:database_-_rdbms:23.4.0-23.26.3:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "Oracle Database Server" } ], "category": "product_family", "name": "Oracle Database Server" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": ">=12.2.0.1.16|<=12.2.0.1.52", "product": { "name": "Oracle Global Lifecycle Management OPatch Version 12.2.0.1.16-12.2.0.1.52", "product_id": "P-12753V-12.2.0.1.16-12.2.0.1.52", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:global_lifecycle_management_opatch:12.2.0.1.16-12.2.0.1.52:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "Oracle Global Lifecycle Management OPatch" } ], "category": "product_family", "name": "Oracle Global Lifecycle Management" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "Oracle Hospitality Cruise Shipboard Property Management (SPMS) Version 23.3.4", "product": { "name": "Oracle Hospitality Cruise Shipboard Property Management (SPMS) Version 23.3.4", "product_id": "P-11705V-23.3.4", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management:23.3.4:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "Oracle Hospitality Cruise Shipboard Property Management (SPMS) Version 23.3.5", "product": { "name": "Oracle Hospitality Cruise Shipboard Property Management (SPMS) Version 23.3.5", "product_id": "P-11705V-23.3.5", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management:23.3.5:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "Oracle Hospitality Cruise Shipboard Property Management (SPMS) Version 23.3.6", "product": { "name": "Oracle Hospitality Cruise Shipboard Property Management (SPMS) Version 23.3.6", "product_id": "P-11705V-23.3.6", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management:23.3.6:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "Oracle Hospitality Cruise Shipboard Property Management (SPMS)" } ], "category": "product_family", "name": "Oracle Hospitality Applications" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "Oracle GraalVM Enterprise Edition Version 21.3.20.0.2", "product": { "name": "Oracle GraalVM Enterprise Edition Version 21.3.20.0.2", "product_id": "P-13497V-21.3.20.0.2", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:graalvm:21.3.20.0.2:*:*:*:enterprise:*:*:*" } } } ], "category": "product_name", "name": "Oracle GraalVM Enterprise Edition" }, { "branches": [ { "category": "product_version", "name": "Oracle GraalVM for JDK Version 17.0.21.0.2", "product": { "name": "Oracle GraalVM for JDK Version 17.0.21.0.2", "product_id": "P-13497V-17.0.21.0.2", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.21.0.2:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "Oracle GraalVM for JDK Version 21.0.13.0.2", "product": { "name": "Oracle GraalVM for JDK Version 21.0.13.0.2", "product_id": "P-13497V-21.0.13.0.2", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.13.0.2:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "Oracle GraalVM for JDK" }, { "branches": [ { "category": "product_version", "name": "Oracle Java SE Version 11.0.33.0.2", "product": { "name": "Oracle Java SE Version 11.0.33.0.2", "product_id": "P-856(Java SE)V-11.0.33.0.2", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:java_se:11.0.33.0.2:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "Oracle Java SE Version 17.0.21.0.2", "product": { "name": "Oracle Java SE Version 17.0.21.0.2", "product_id": "P-856(Java SE)V-17.0.21.0.2", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:java_se:17.0.21.0.2:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "Oracle Java SE Version 21.0.13.0.2", "product": { "name": "Oracle Java SE Version 21.0.13.0.2", "product_id": "P-856(Java SE)V-21.0.13.0.2", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:java_se:21.0.13.0.2:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "Oracle Java SE Version 25.0.5.0.2", "product": { "name": "Oracle Java SE Version 25.0.5.0.2", "product_id": "P-856(Java SE)V-25.0.5.0.2", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:java_se:25.0.5.0.2:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "Oracle Java SE Version 27.0.1.0.2", "product": { "name": "Oracle Java SE Version 27.0.1.0.2", "product_id": "P-856(Java SE)V-27.0.1.0.2", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:java_se:27.0.1.0.2:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "Oracle Java SE Version 8u511-b32", "product": { "name": "Oracle Java SE Version 8u511-b32", "product_id": "P-856(Java SE)V-8u511-b32", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:java_se:8u511-b32:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "Oracle Java SE Version 8u511-perf-b32", "product": { "name": "Oracle Java SE Version 8u511-perf-b32", "product_id": "P-856(Java SE)V-8u511-perf-b32", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:java_se:8u511-perf-b32:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "Oracle Java SE" } ], "category": "product_family", "name": "Oracle Java SE" } ], "category": "vendor", "name": "Oracle" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-114820", "ids": [ { "system_name": "Oracle Bug ID of Oracle Java SE", "text": "40196710" }, { "system_name": "Oracle Bug ID of Oracle Database Server", "text": "40192148" }, { "system_name": "Oracle Bug ID of Oracle Autonomous Health Framework", "text": "40200575" }, { "system_name": "Oracle Bug ID of Oracle Global Lifecycle Management OPatch", "text": "40200542" }, { "system_name": "Oracle Bug ID of Oracle Hospitality Cruise Shipboard Property Management (SPMS)", "text": "40222251" } ], "notes": [ { "category": "description", "text": "Vulnerability in the RDBMS (Java) component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise RDBMS (Java). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all RDBMS (Java) accessible data as well as unauthorized access to critical data or complete access to all RDBMS (Java) accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).", "title": "Vulnerability Description" }, { "category": "description", "text": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).", "title": "Vulnerability Description" }, { "category": "description", "text": "Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management (SPMS) product of Oracle Hospitality Applications (component: Next-Gen SPMS (Java)). Supported versions that are affected are 23.3.4, 23.3.5 and 23.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Hospitality Cruise Shipboard Property Management (SPMS). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Cruise Shipboard Property Management (SPMS) accessible data as well as unauthorized access to critical data or complete access to all Oracle Hospitality Cruise Shipboard Property Management (SPMS) accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).", "title": "Vulnerability Description" }, { "category": "description", "text": "Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer (Java)). Supported versions that are affected are 26.3-26.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Autonomous Health Framework. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Autonomous Health Framework accessible data as well as unauthorized access to critical data or complete access to all Oracle Autonomous Health Framework accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).", "title": "Vulnerability Description" }, { "category": "description", "text": "Vulnerability in the Oracle Global Lifecycle Management OPatch product of Oracle Global Lifecycle Management (component: Patch Installer (Java)). Supported versions that are affected are 12.2.0.1.16-12.2.0.1.52. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Global Lifecycle Management OPatch. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management OPatch accessible data as well as unauthorized access to critical data or complete access to all Oracle Global Lifecycle Management OPatch accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "P-5(RDBMS-Java)V-21.3-21.23", "P-856(Java SE)V-8u511-perf-b32", "P-13497V-21.0.13.0.2", "P-856(Java SE)V-8u511-b32", "P-856(Java SE)V-27.0.1.0.2", "P-12753V-12.2.0.1.16-12.2.0.1.52", "P-856(Java SE)V-11.0.33.0.2", "P-11705V-23.3.5", "P-11705V-23.3.4", "P-5(RDBMS-Java)V-23.4.0-23.26.3", "P-11705V-23.3.6", "P-14634V-26.3-26.10", "P-5(RDBMS-Java)V-19.3-19.32", "P-13497V-21.3.20.0.2", "P-856(Java SE)V-21.0.13.0.2", "P-13497V-17.0.21.0.2", "P-856(Java SE)V-17.0.21.0.2", "P-856(Java SE)V-25.0.5.0.2" ] }, "remediations": [ { "category": "vendor_fix", "details": "Oracle customers with valid support contracts", "product_ids": [ "P-5(RDBMS-Java)V-21.3-21.23", "P-5(RDBMS-Java)V-19.3-19.32", "P-12753V-12.2.0.1.16-12.2.0.1.52", "P-5(RDBMS-Java)V-23.4.0-23.26.3", "P-14634V-26.3-26.10" ], "url": "https://support.oracle.com/support/?documentId=CPU359" }, { "category": "vendor_fix", "details": "Oracle customers with valid support contracts", "product_ids": [ "P-13497V-21.3.20.0.2", "P-856(Java SE)V-8u511-perf-b32", "P-13497V-21.0.13.0.2", "P-856(Java SE)V-8u511-b32", "P-856(Java SE)V-21.0.13.0.2", "P-856(Java SE)V-27.0.1.0.2", "P-13497V-17.0.21.0.2", "P-856(Java SE)V-17.0.21.0.2", "P-856(Java SE)V-25.0.5.0.2", "P-856(Java SE)V-11.0.33.0.2" ], "url": "https://support.oracle.com/support/?documentId=CPU427" }, { "category": "vendor_fix", "details": "Oracle customers with valid support contracts", "product_ids": [ "P-11705V-23.3.5", "P-11705V-23.3.4", "P-11705V-23.3.6" ], "url": "https://support.oracle.com/support/?documentId=CPU430" } ], "scores": [ { "cvss_v3": { "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "P-5(RDBMS-Java)V-21.3-21.23", "P-856(Java SE)V-8u511-perf-b32", "P-13497V-21.0.13.0.2", "P-856(Java SE)V-8u511-b32", "P-856(Java SE)V-27.0.1.0.2", "P-12753V-12.2.0.1.16-12.2.0.1.52", "P-856(Java SE)V-11.0.33.0.2", "P-11705V-23.3.5", "P-11705V-23.3.4", "P-5(RDBMS-Java)V-23.4.0-23.26.3", "P-11705V-23.3.6", "P-14634V-26.3-26.10", "P-5(RDBMS-Java)V-19.3-19.32", "P-13497V-21.3.20.0.2", "P-856(Java SE)V-21.0.13.0.2", "P-13497V-17.0.21.0.2", "P-856(Java SE)V-17.0.21.0.2", "P-856(Java SE)V-25.0.5.0.2" ] } ] } ] }