Security Compliance

SolarWinds Products and Oracle Java SE and OpenJDK Vulnerabilities

This article addresses vulnerabilities in Oracle Java SE as described in CVE-2023-21830, CVE-2023-21835, CVE-2023-21843, CVE-2023-21938, CVE-2024-20918, CVE-2024-20919, CVE-2024-20921, CVE-2024-20926, CVE-2024-20945, CVE-2024-20952, CVE-2024-20932, CVE-2024-21131, CVE-2024-21138, CVE-2024-21140, CVE-2024-21144, CVE-2024-21145, CVE-2024-21147, CVE-2025-21587, CVE-2025-21587, CVE-2025-30691, CVE-2025-30698, CVE-2025-21502, CVE-2025-50059, CVE-2025-30749, CVE-2025-50106, CVE-2025-30761, CVE-2025-30754, CVE-2025-53057, CVE-2025-53066, CVE-2025-61748, CVE-2025-30752, CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, and CVE-2026-21945, CVE-2026-22007, CVE-2026-22008, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-34268, CVE-2026-34282, CVE-2026-47057, CVE-2026-47063, CVE-2026-47058, CVE-2026-60147, CVE-2026-46968, CVE-2026-47059, CVE-2026-47027, CVE-2026-47021, CVE-2026-46917, and CVE-2026-47010.

First published date

5/30/2023 1:10 PM

Last published date

8/5/2026 3:36 PM

Overview

From 2023 to 2026, the following security bulletins were released to address vulnerabilities in Oracle Java SE:

CVE-2023-21830

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization).

CVE-2023-21835

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).

CVE-2023-21843

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound).

CVE-2023-21938

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).

CVE-2024-20918

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).

CVE-2024-20919

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).

CVE-2024-20921

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).

CVE-2024-20926

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting).

CVE-2024-20945

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).

CVE-2024-20952

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).

CVE-2024-20932

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).

CVE-2024-21131

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).

CVE-2024-21138

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).

CVE-2024-21140

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).

CVE-2024-21144

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Concurrency).

CVE-2024-21145

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).

CVE-2024-21147

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).

CVE-2025-21502

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).

CVE-2024-21235

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).

CVE-2024-21210

Describes a vulnerability in Oracle Java SE (component: Hotspot).

CVE-2024-21208

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).

CVE-2024-21217

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization).

CVE-2024-21094

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).

CVE-2024-21085

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Concurrency).

CVE-2024-21011

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).

CVE-2024-21068

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).

CVE-2024-21012

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).

CVE-2025-21587

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).

CVE-2025-30691

Describes a vulnerability in Oracle Java SE (component: Compiler).

CVE-2025-30698

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).

CVE-2025-50059

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).

CVE-2025-30749

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).

CVE-2025-50106

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).

CVE-2025-30761

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting).

CVE-2025-30754

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).

CVE-2025-53057

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).

CVE-2025-53066

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).

CVE-2025-61748

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).

CVE-2025-30752

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler).

CVE-2026-21925

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI).

CVE-2026-21932

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX).

CVE-2026-21933

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).

CVE-2026-21945

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).

CVE-2026-22007

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).

CVE-2026-22008

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).

CVE-2026-22013

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).

CVE-2026-22016

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).

CVE-2026-22018

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).

CVE-2026-22021

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).

CVE-2026-34268

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).

CVE-2026-34282

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).

CVE-2026-47057

Describes a vulnerability in Oracle Java SE (component: Scripting).

CVE-2026-47063

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).

CVE-2026-47058

Describes a vulnerability in Oracle Java SE (component: Scripting).

CVE-2026-60147

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).

CVE-2026-46968

Describes a vulnerability in Oracle Java SE (component: JSSE).

CVE-2026-47059

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).

CVE-2026-47027

Describes a vulnerability in Oracle Java SE (component: Libraries).

CVE-2026-47021

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).

CVE-2026-46917

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).

CVE-2026-47010

Describes a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO).

The vulnerabilities described in these CVEs impact numerous software companies.

Product section

Security Event Manager

Cause

CVE-2023-21830, CVE-2023-21835, CVE-2023-21843, CVE-2023-21938, CVE-2024-20918, CVE-2024-20919, CVE-2024-20921, CVE-2024-20926, CVE-2024-20945, CVE-2024-20952, CVE-2024-20932, CVE-2024-21131, CVE-2024-21138, CVE-2024-21140, CVE-2024-21144, CVE-2024-21145, CVE-2024-21147, CVE-2025-21587, CVE-2025-21587, CVE-2025-30691, CVE-2025-30698, CVE-2025-21502, CVE-2025-50059, CVE-2025-30749, CVE-2025-50106, CVE-2025-30761, CVE-2025-30754, CVE-2025-53057, CVE-2025-53066, CVE-2025-61748, CVE-2025-30752, CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, CVE-2026-21945, CVE-2026-22007, CVE-2026-22008, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-34268, CVE-2026-34282, CVE-2026-47057, CVE-2026-47063, CVE-2026-47058, CVE-2026-60147, CVE-2026-46968, CVE-2026-47059, CVE-2026-47027, CVE-2026-47021, CVE-2026-46917, and CVE-2026-47010.

Resolution

These vulnerabilities apply to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (for example, code that comes from the Internet) and rely on the Java sandbox for security. These vulnerabilities do not apply to Java deployments, typically in servers, that load and run only trusted code.

Security Event Manager (SEM), Database Performance Analyzer (DPA), and SolarWinds Platform products (such as Hybrid Cloud Observability, NPM, and SAM) are not impacted by these vulnerabilities, because these applications do not load untrusted code and do not use sandboxed Java applets or Java Web Start.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.