CVE-2022-21476

What it actually does

The flaw in the Libraries component permits an unauthenticated remote attacker to read arbitrary critical data from the Java runtime via network protocols or by supplying data to exposed APIs, bypassing sandbox restrictions in deployments that process untrusted code.

Why it matters to the business

Organizations running the affected Java versions across Oracle, NetApp, Debian, and Azul products face risk of large-scale data theft from client-side or server-side Java deployments, increasing breach exposure in widely used enterprise environments with stable but non-zero exploit probability.

How an attack unfolds

An attacker with network access targets Java deployments that load untrusted code or expose library APIs, crafts requests or supplies malicious data over multiple protocols to trigger the information disclosure and extract sensitive data without authentication.

How to fix it

Upgrade Oracle Java SE beyond 7u331/8u321/11.0.14/17.0.2/18, GraalVM Enterprise Edition beyond 20.3.5/21.3.1/22.0.0.2, and apply corresponding patches to all listed NetApp, Debian, and Azul products; restrict exposure of sandboxed Java environments and API endpoints in the interim.

How to confirm the fix worked

Confirm installed Java and GraalVM versions exceed the affected releases, run vendor-provided security update verification tools, and retest affected deployments with network scanners or proof-of-concept checks for the data disclosure condition.

Typical attack path

1. Locate publicly reachable Java services or sandboxed applets/Web Start applications
2. Establish unauthenticated network connection via supported protocols
3. Supply crafted input or untrusted code to the Libraries component
4. Extract critical data returned due to the disclosure flaw

How to detect it

Review network logs for unexpected connections to Java processes, inspect application logs for anomalous data access patterns from library calls, and search endpoint telemetry for Java runtime activity tied to untrusted code execution.

What your security team should do

• Apply vendor patches to all Oracle Java, GraalVM, and downstream NetApp/Debian/Azul installations immediately
• Limit network exposure of Java services and sandboxed applications
• Review and harden API endpoints that feed data to the Libraries component
• Monitor EPSS stability and re-evaluate if exploit maturity increases