Oracle Java SE critical RCE flaws require immediate patching under DORA

1. Executive summary

Oracle published the October 2026 Critical Patch Update (cpuoct2026) on 20 October 2026, and CERT-FR issued advisory CERTFR-2026-AVI-1350 the following day covering the Java SE, JavaFX and GraalVM components. The update addresses a large CVE set, of which two carry CVSS 8.8 HIGH: CVE-2024-4367 (EPSS 71%) and CVE-2026-28847 (EPSS 1%). Neither is in CISA KEV, so there is no confirmed in-the-wild exploitation and no federal remediation deadline. The exposure for EMEA financial services is the installed base: Java 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 26.0.2 and 27, plus GraalVM and JavaFX builds, sit inside payment switches, core banking middleware, market-data adapters and internally built trade-processing services where a JVM compromise reaches transaction integrity directly. CVE-2024-4367 at 71% EPSS is the item to close first.

2. Regulatory framing

3. Technical analysis & attack chain

CERT-FR classifies the impact as remote arbitrary code execution, remote denial of service, data confidentiality and integrity compromise, and security policy bypass. It gives no per-CVE mechanism, no attack vector detail and no proof-of-concept. Oracle's cpuoct2026 bulletin is the authoritative technical source and was not available for this note; the mechanism for each CVE below is therefore limited to what NVD records.

Triage table, ordered by EPSS from NVD/EPSS data:

The remaining CVEs listed in CERTFR-2026-AVI-1350 (CVE-2026-28857 through CVE-2026-91487) have no NVD, EPSS or KEV record in the data available for this note. They are covered by the same Oracle CPU and the same version upgrade; no individual severity is asserted here.

Attack chain, confirmed steps only:

1. The attacker targets a host running one of the affected builds: Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 26.0.2 or 27; GraalVM Enterprise 21.3.19.1.1, GraalVM for JDK 17.0.20.1 or 21.0.12.1; or JavaFX 21.0.12, 25.0.4 or 27.
2. CERT-FR states the flaws permit remote code execution, remote denial of service and confidentiality/integrity compromise. The specific entry vector per CVE (for example a deserialization path, a JNI boundary or a JavaFX rendering path) is not stated in the CERT-FR advisory and is not asserted here.
3. No post-exploitation behaviour, payload, persistence mechanism, C2 channel or lateral-movement technique is described in any source for this item.

CVE-2024-4367 is a 2024 identifier appearing in the October 2026 CPU. The sources do not explain why; it may be a component that only now received a fix in the Java SE bundle, or a re-listing. The 71% EPSS score indicates active exploitation likelihood independent of the identifier's age, so the patch decision does not depend on resolving that question.

Confidence caveats: every technical claim above rests on CERT-FR and NVD only. No vendor bulletin text, no exploit code and no telemetry were available. No threat actor is named in any source and no MITRE ATT&CK profile applies; any attribution would be speculation and none is offered.

4. Mitigation & containment

P1, within 24 hours:

• Inventory every JVM on the estate and flag any host reporting java -version output matching 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 26.0.2 or 27, plus GraalVM 21.3.19.1.1 / 17.0.20.1 / 21.0.12.1 and JavaFX 21.0.12 / 25.0.4 / 27. Prioritise internet-facing and payment-path systems.
• Apply the Oracle cpuoct2026 fixes to CVE-2024-4367 and CVE-2026-28847 first. Oracle's bulletin is the patch source: https://www.oracle.com/security-alerts/cpuoct2026.html
• Where a patch cannot be applied inside 24 hours, restrict network reachability to the affected service and raise monitoring on the JVM process (unexpected child processes, outbound connections from the Java process, JVM crash loops indicating DoS attempts).

P2, within 72 hours:

• Complete the cpuoct2026 rollout across the remaining affected versions, including GraalVM and JavaFX components bundled into desktop or build tooling.
• Pin container base images and CI build images to the patched JDK builds so rebuilt artefacts do not reintroduce the vulnerable runtime.
• Check for orphaned or end-of-support JVMs (notably Java 8u503 and any GraalVM Enterprise 21.3 line) and record them as third-party risk items under DORA Art. 28.

P3, within 7 days:

• Add JVM version currency to the standard build gate: reject artefacts built against a JDK below the current CPU level.
• Re-run the inventory quarterly against Oracle CPU releases; the August (CERTFR-2026-AVI-1048) and July (CERTFR-2026-AVI-0915) CERT-FR Java advisories show this is a recurring cycle, not a one-off.

5. Indicators of compromise

No indicators of compromise available in the source material. CERT-FR, the Oracle bulletin reference and the related CERT-FR advisories contain no hashes, domains, IP addresses, file paths or behavioural telemetry. No atomic indicators exist to pivot on; detection must rest on version identification and process behaviour (§6).

6. Detection

The sources contain no threat artefacts (no strings, filenames, mutexes, registry keys or command lines from any exploit or payload), so a YARA rule would detect reporting about the flaw rather than the flaw. None is emitted.

Version-based detection is possible from the affected-version list. The following Sigma-style logic is a template for a configuration or asset-inventory query; the version strings are taken verbatim from CERTFR-2026-AVI-1350 and must be matched against your own inventory source (EDR software inventory, CMDB or java -version collection), not against process command lines, because the advisory gives no command-line artefact.

title: Oracle Java SE, GraalVM or JavaFX build matching CERTFR-2026-AVI-1350 affected versions
id: 6f1c2a90-4b7e-4d21-9a3c-0e5b7d9c1a44
status: experimental
description: Flags assets reporting a JVM or JavaFX version listed as affected in CERTFR-2026-AVI-1350 (Oracle cpuoct2026). Version strings are from the CERT-FR advisory.
author: Adverse Trace
date: 2026-10-26
references:

  - https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1350/
  - https://www.oracle.com/security-alerts/cpuoct2026.html
logsource:
  category: asset_inventory
  product: generic
detection:
  java_se:
    software_version:

      - '8u503'
      - '8u503-perf'
      - '11.0.32.1'
      - '17.0.20.1'
      - '21.0.12.1'
      - '25.0.4.1'
      - '26.0.2'
      - '27'
  graalvm:
    software_version:

      - '21.3.19.1.1'
      - '17.0.20.1'
      - '21.0.12.1'
  javafx:
    software_version:

      - '21.0.12'
      - '25.0.4'
      - '27'
  condition: java_se or graalvm or javafx
falsepositives:

  - Inventory records that have not been refreshed since the cpuoct2026 upgrade
level: high

Note that 17.0.20.1, 21.0.12.1 and 27 appear in more than one product line; correlate the match with the product name before opening a ticket.

CVE assessment

10 referenced CVEs

7. Sources

• ANSSI / CERT-FR, "Multiples vulnérabilités dans Oracle Java SE" (CERTFR-2026-AVI-1350), 21 October 2026. https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1350/
• Oracle, "Oracle Critical Patch Update Advisory, October 2026" (cpuoct2026), 20 October 2026, cited by CERT-FR. https://www.oracle.com/security-alerts/cpuoct2026.html
• ANSSI / CERT-FR, "Multiples vulnérabilités dans Oracle Java SE" (CERTFR-2026-AVI-1048), 19 August 2026. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1048/
• ANSSI / CERT-FR, "Multiples vulnérabilités dans Oracle Java SE" (CERTFR-2026-AVI-0915), 23 July 2026. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0915/
• BSI, WID-SEC-2026-4139, Oracle Java SE, GraalVM and OpenJDK security-bypass advisory. https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4139
• NVD, EPSS and CISA KEV records for the ten CVEs scored in §3 (CVE-2024-4367, CVE-2024-47778, CVE-2026-101516, CVE-2026-101737, CVE-2026-1940, CVE-2026-20643, CVE-2026-20664, CVE-2026-20665, CVE-2026-20691, CVE-2026-28847).

8. Adverse Trace position

Adverse Trace assesses this as a high-priority patch cycle rather than an active incident: the top score is CVSS 8.8 HIGH, no CVE in the set is in CISA KEV, and no exploitation is confirmed in any source. The 71% EPSS on CVE-2024-4367 is the one figure that changes the calculus, because it indicates a high probability of exploitation attempts in the near term even without KEV listing, and it sits on a runtime that EMEA banks rarely have full visibility of. Client impact concentrates in payment processing, core banking middleware and trade systems where a JVM compromise reaches transaction integrity and confidentiality, which is why DORA Art. 28 and Art. 30 third-party obligations apply to the JVM as a tracked dependency. We will pull the Oracle cpuoct2026 bulletin to add per-CVE mechanism detail and confirm whether CVE-2024-4367 is a re-listing, and we will re-issue this advisory if any of the ten scored CVEs enters CISA KEV or if EPSS on CVE-2024-4367 moves further. Clients should return their affected-version inventory to their Adverse Trace contact within 72 hours so we can track remediation against the cpuoct2026 baseline.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.