CVE-2022-21296

What it actually does

The JAXP component in affected Java runtimes permits an unauthenticated network attacker to read a limited subset of data that would otherwise be inaccessible.

Why it matters to the business

Organizations running vulnerable Java deployments face potential exposure of sensitive configuration or application data, increasing compliance and reputational risk across widely deployed enterprise and cloud environments.

How an attack unfolds

An attacker with network reachability supplies crafted data through JAXP APIs, either by loading untrusted code in a sandboxed applet or by invoking the component directly via a web service or client application, resulting in unauthorized read access.

How to fix it

Upgrade Oracle Java SE to releases newer than 7u321, 8u311, 11.0.13 or 17.0.1 and GraalVM Enterprise Edition to releases newer than 20.3.4 or 21.3.0. Apply equivalent patches to all downstream products such as NetApp components and Debian packages. Disable or sandbox unnecessary JAXP usage where upgrades are delayed.

How to confirm the fix worked

Inventory all Java runtimes, confirm versions exceed the listed affected releases, and test that JAXP calls no longer leak data under the same network conditions used for discovery.

Typical attack path

1. Locate publicly reachable Java deployments or services that invoke JAXP
2. Send crafted XML or data payloads that trigger the vulnerable code path
3. Observe returned responses containing otherwise protected data
4. Repeat to enumerate accessible information

How to detect it

Review web server, application server and Java process logs for unexpected JAXP-related exceptions or data-return patterns from untrusted sources; correlate with network flows showing repeated small data exfiltration attempts.

What your security team should do

• Immediately inventory all Oracle JDK, JRE, GraalVM and downstream NetApp installations
• Prioritize upgrades on any internet-facing or multi-tenant Java deployments
• Apply network segmentation to limit unauthenticated access to Java services
• Review application code for direct use of JAXP APIs with untrusted input