Ubuntu Multiple CRaC JDK and OpenJDK Vulnerabilities Discovered
Article Content
- •Multiple vulnerabilities found in CRaC JDK and OpenJDK versions, affecting authentication.
- •Remote unauthenticated attackers can exploit these vulnerabilities for unauthorized access.
- •Immediate patching is required for affected systems to prevent potential exploits.
On May 28, 2026, Ubuntu published security notices for vulnerabilities in various Java Development Kits (JDKs). Discovered by Thomas Beckers, these vulnerabilities affect CRaC JDK 25, JDK 21, JDK 17, OpenJDK 11, and OpenJDK 8. Key issues include improper authentication in components like JAXP, JSSE, and Networking, allowing remote unauthenticated attackers to gain unauthorized access to sensitive information or cause denial of service. Specific CVEs include CVE-2026-22016, CVE-2026-34282, and CVE-2026-22021, all published on April 21, 2026. The vulnerabilities pose a significant risk to systems utilizing these JDK versions, necessitating immediate patching by affected users. The current status indicates that users should update their systems to mitigate these risks.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (8)
Following this threat?
Track Ubuntu and CVE-2026-22007 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…