LiveActive security incident?Get immediate response
CVE Record

CVE-2021-2369: Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libra...

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Library). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).

MediumCVSS 4.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a medium-severity Java vulnerability mainly relevant to clients that run untrusted Java Web Start applications or sandboxed applets. An unauthenticated network attacker could cause limited unauthorized data changes, but the attack requires user interaction and does not apply to typical servers that run only trusted administrator-installed Java code.

Executive priority

Treat this as a targeted remediation item, not an emergency. Prioritize legacy Java client use and third-party products bundling affected Java versions. Server environments running only trusted Java code generally carry lower urgency based on Oracle's stated scope.

Technical view

CVE-2021-2369 affects Oracle Java SE 7u301, 8u291, 11.0.11, 16.0.1 and GraalVM Enterprise Edition 20.3.2 and 21.1.0. Oracle describes it as a Library component issue with CVSS 4.3: network attack vector, low complexity, no privileges, required user interaction, and low integrity impact only.

Likely exposure

Exposure is most likely on endpoints or legacy environments that still run sandboxed Java Web Start applications, sandboxed applets, or untrusted internet-sourced Java code. Standard server-side Java deployments running only trusted code are specifically excluded by Oracle's description.

Exploitation context

The provided sources do not show CISA KEV listing or confirmed active exploitation. The attack scenario requires a user to interact with untrusted Java content reachable over network protocols, limiting broad automated exploitation risk.

Researcher notes

The key scoping detail is Oracle's note limiting applicability to sandboxed client-style Java deployments running untrusted code. Impact is integrity-only with no confidentiality or availability impact in the CVSS vector. Evidence for real-world exploitation is not present in the supplied bundle.

Mitigation direction

  • Apply Oracle Java SE or GraalVM updates from the relevant Critical Patch Update guidance.
  • Apply OpenJDK packages from your OS vendor advisory where applicable.
  • Remove or disable Java Web Start, applets, and untrusted Java execution where not required.
  • Prioritize endpoints that rely on the Java sandbox for untrusted code.
  • Check product-specific vendor advisories before assuming bundled Java runtimes are fixed.

Validation and detection

  • Inventory Java SE, OpenJDK, and GraalVM versions across endpoints and managed images.
  • Identify systems running Java Web Start, browser applets, or untrusted Java code.
  • Compare installed versions against Oracle and OS vendor security advisories.
  • Confirm patched package versions through endpoint management or package inventory.
  • Document server deployments that only run trusted code as lower exposure.
Prepared
Confidence
high
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-2369 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
8Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4.3CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N2.81.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

4.3Medium
CVSS 3.1 vector shape for CVE-2021-2369Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Oracle CorporationJava SE JDK and JREJava SE:7u301, Java SE:8u291, Java SE:11.0.11, Java SE:16.0.1, Oracle GraalVM Enterprise Edition:20.3.2, Oracle GraalVM Enterprise Edition:21.1.0Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.