CVE-2022-21618

What it actually does

Flaw in the JGSS component permits unauthenticated network attackers to bypass authorization controls via Kerberos, resulting in unauthorized modification (update/insert/delete) of accessible data within Java SE and GraalVM deployments that process untrusted code in sandboxed contexts or expose the affected APIs.

Why it matters to the business

Attackers can silently alter data in Java-based applications and services without credentials, risking integrity violations across client deployments, web services, and enterprise systems that rely on Java for sandboxed or API-driven workloads; broad downstream usage in operating systems and appliances increases exposure surface.

How an attack unfolds

An attacker with network reachability crafts Kerberos requests targeting the JGSS component in vulnerable Java runtimes; the authorization bypass allows direct modification of data without authentication, particularly effective against sandboxed Web Start applications, applets, or services accepting untrusted input through the exposed APIs.

How to fix it

Upgrade Oracle Java SE beyond 17.0.4.1 and 19, and Oracle GraalVM Enterprise Edition beyond 21.3.3 and 22.2.0; apply vendor patches for all listed affected products including downstream distributions; restrict Kerberos exposure and sandbox untrusted code execution until updates are complete.

How to confirm the fix worked

Inventory all Java runtimes and confirm versions exceed the affected releases; test connectivity and API behavior post-upgrade to ensure the JGSS authorization controls are enforced; review Oracle security advisories for patch confirmation.

Typical attack path

1. Locate publicly reachable Java deployments using affected versions and the JGSS component
2. Craft and send unauthenticated Kerberos network traffic to trigger the authorization flaw
3. Perform unauthorized data modifications via the compromised component or API surface

How to detect it

Review network logs for anomalous unauthenticated Kerberos traffic directed at Java processes; inspect application and system logs for unexpected data modifications originating from JGSS or related APIs; correlate with Java process activity handling external or untrusted inputs.

What your security team should do

• Prioritize patching of all Oracle Java SE and GraalVM instances to non-affected versions
• Limit network exposure of Kerberos services and Java APIs to trusted sources only
• Audit sandbox configurations and remove reliance on untrusted code where possible
• Monitor EPSS trend and re-evaluate exploit maturity as new information emerges