CVE-2026-21925: Oracle Java SE RMI Privilege Escalation

CVE-2026-21925 Overview

A vulnerability has been identified in the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products, specifically within the Remote Method Invocation (RMI) component. This security flaw allows an unauthenticated attacker with network access to potentially compromise affected systems through multiple network protocols.

The vulnerability is considered difficult to exploit but can be triggered remotely without requiring user interaction or authentication. Successful exploitation can result in unauthorized data modification (insert, update, or delete operations) and unauthorized read access to a subset of accessible data within the affected products.

Critical Impact

Successful exploitation enables unauthorized data modification and information disclosure in Oracle Java SE and GraalVM deployments through the RMI component, affecting both server-side API implementations and client-side sandboxed Java applications.

Affected Products

• Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1
• Oracle GraalVM for JDK: 17.0.17 and 21.0.9
• Oracle GraalVM Enterprise Edition: 21.3.16

Discovery Timeline

• January 20, 2026 - CVE-2026-21925 published to NVD
• January 20, 2026 - Last updated in NVD database

Technical Details for CVE-2026-21925

Vulnerability Analysis

This vulnerability resides in the Remote Method Invocation (RMI) component of Oracle Java SE and GraalVM products. RMI is a Java API that enables remote communication between Java Virtual Machines, allowing objects in one JVM to invoke methods on objects residing in another JVM.

The flaw can be exploited through APIs in the RMI component, including scenarios where a web service supplies data to these APIs. This makes the vulnerability particularly relevant for enterprise environments that expose Java-based services over the network.

The vulnerability has two distinct attack surfaces:

1. Server-side exploitation - Attackers can target web services or applications that utilize RMI APIs for remote communication
2. Client-side exploitation - Affects Java deployments running sandboxed Java Web Start applications or sandboxed Java applets that load and execute untrusted code from the internet

Due to the high attack complexity requirement, successful exploitation requires specific conditions to be met, making opportunistic attacks less likely while targeted attacks remain a concern.

Root Cause

The vulnerability stems from improper handling within the RMI component that allows network-accessible attackers to bypass intended security restrictions. While the specific technical details have not been disclosed, the vulnerability affects the integrity and confidentiality controls within the RMI implementation, enabling both data manipulation and information disclosure.

The flaw impacts the Java sandbox security model, which is designed to restrict untrusted code execution. Applications relying on the sandbox for security isolation may be at risk when processing untrusted content through RMI interfaces.

Attack Vector

The attack vector is network-based, requiring the attacker to have network access to the target system running vulnerable Java or GraalVM versions. The exploitation can occur through multiple network protocols supported by the RMI component.

Exploitation scenarios include:

1. API-based attacks - Targeting web services that process external data through RMI APIs, where malicious input can trigger the vulnerability
2. Sandbox escape attempts - In client-side deployments, untrusted code loaded from the internet may leverage this vulnerability to access data outside the sandbox boundaries
3. Inter-service communication - Compromising RMI-based communication between distributed Java applications in enterprise environments

The attack does not require authentication or user interaction, though the high complexity means specific conditions must align for successful exploitation.

Detection Methods for CVE-2026-21925

Indicators of Compromise

• Unusual RMI traffic patterns or connections from unexpected sources to RMI service ports (typically 1099 or custom-configured ports)
• Anomalous data access or modification events in applications utilizing RMI components
• Unexpected outbound connections from Java processes following RMI activity
• Log entries indicating failed or unusual RMI method invocations

Detection Strategies

• Monitor network traffic for suspicious RMI protocol activity, particularly from untrusted network segments
• Implement application-level logging for RMI component interactions and data access patterns
• Deploy intrusion detection rules targeting known RMI exploitation techniques
• Review Java application logs for serialization errors or unexpected class loading events

Monitoring Recommendations

• Enable verbose logging for RMI components in production environments temporarily during the patch assessment period
• Configure network monitoring to alert on RMI traffic from unauthorized sources
• Implement file integrity monitoring on Java installation directories to detect unauthorized modifications
• Set up alerts for Java process behavior anomalies, including unexpected network connections or file system access

How to Mitigate CVE-2026-21925

Immediate Actions Required

• Inventory all systems running affected Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition versions
• Apply the security patch from Oracle's January 2026 Critical Patch Update immediately
• Restrict network access to RMI services using firewall rules until patches can be applied
• Review and audit applications that utilize RMI functionality for exposure to untrusted input

Patch Information

Oracle has addressed this vulnerability in the January 2026 Critical Patch Update. Organizations should obtain the appropriate patches from the Oracle Security Alert January 2026 advisory.

Upgrade paths by product:

• Oracle Java SE: Update to the latest patched versions beyond 8u471, 11.0.29, 17.0.17, 21.0.9, and 25.0.1
• Oracle GraalVM for JDK: Update beyond versions 17.0.17 and 21.0.9
• Oracle GraalVM Enterprise Edition: Update beyond version 21.3.16

Workarounds

• Implement network segmentation to isolate RMI services from untrusted network zones
• Configure RMI filters using ObjectInputFilter to restrict deserialization of untrusted classes
• Disable RMI functionality in applications where it is not required
• For client-side deployments, prevent loading of untrusted Java Web Start applications or applets until patches are applied
• Implement application-layer controls to validate and sanitize data before it reaches RMI APIs

# Configuration example
# Example: Configure JVM with RMI filter to restrict deserialization
# Add to Java startup options to limit accepted classes
java -Djdk.serialFilter="!*" -jar your-application.jar

# Example: Restrict RMI access using iptables (Linux)
# Block external access to default RMI port
iptables -A INPUT -p tcp --dport 1099 -s ! 10.0.0.0/8 -j DROP

# Example: Enable RMI debugging for monitoring
java -Dsun.rmi.server.exceptionTrace=true -Djava.rmi.server.logCalls=true -jar your-application.jar