CVE-2026-16441: eclipse foundation openj9
CVSS: 9.6v3.1CriticalAnalyzed
AliasesCGA-295h-v6j5-wx7hCGA-2cxg-q674-fvfxCGA-2fg7-6vpx-j4hvCGA-2h2r-8c86-x5hvCGA-2pg7-4j7h-xp5gCGA-2phw-6p27-794cCGA-3q9h-rm65-mpw6CGA-3v2h-7g2g-f787CGA-3wpv-frpv-8mh2CGA-48qx-cwx8-vgj6CGA-4c3p-pf49-74xfCGA-4hwp-wx9c-gfrrCGA-4pgj-6hgq-jvfgCGA-5mv7-qpw5-rq4vCGA-5q86-2c52-xmjrCGA-688p-wqm4-mr32CGA-6c2h-79rr-vg4pCGA-6f48-v844-pqw6CGA-6jgj-ff69-j45jCGA-72pj-424x-wxxrCGA-72xw-q5vh-5p9qCGA-74hr-2pp6-x455CGA-7rr6-fw4r-5mhfCGA-7xwx-wv69-w5xfCGA-82mp-gmhw-382mCGA-85mv-j57v-h9ghCGA-8695-2pvv-742vCGA-8gq6-r5w5-pp3vCGA-8hh9-9cqw-2p99CGA-8jqp-6fh3-gfvqCGA-8w4x-6f97-xh9pCGA-92vf-xj9f-4rhwCGA-973p-f58p-cffcCGA-c5w8-pr7j-r932CGA-ch27-wp6m-rxh4CGA-fh9f-2v9q-wmmfCGA-fhr5-f8mq-pf6mCGA-fp39-w94c-9xvrCGA-gcmg-rrfp-ghhgCGA-ghq2-36wp-8cxrCGA-hcmc-m423-66pvCGA-hvcv-6w3r-j66cCGA-j62w-fmvj-vgrfCGA-j96r-h6rx-4vr7CGA-jh68-p3xj-3grvCGA-jpch-cr8r-xpxvCGA-jpff-vr9p-p3r3CGA-jq6j-f7m3-46h4CGA-jrmm-fmq6-v25hCGA-m3jv-5726-22xrCGA-m7qx-wjmw-x54mCGA-m96h-46j3-p2cvCGA-mcpp-xv96-xqrrCGA-mf5m-4wr9-9hx5CGA-mg9v-q228-jg7xCGA-mgv9-px3p-rgxpCGA-mm2m-c2wq-6vw2CGA-p9pq-56v2-vwh6CGA-prfj-7qpp-5cv5CGA-q55w-6m7f-7ghfCGA-q874-82vr-xf4mCGA-r3m7-69m7-rf5qCGA-r3mv-p68v-699vCGA-r77p-qffw-xxgpCGA-r7h5-3qr9-3gw3CGA-rmfv-4xw2-4g7hCGA-rqpq-xjwm-4x2gCGA-rvw9-h7c6-vcg2CGA-rx54-g57m-57c3CGA-v28c-grjc-v2mwCGA-v2x8-h84j-5v9rCGA-v6rm-jp9x-98crCGA-v78p-hjqr-3x85CGA-vmg7-hffm-5v74CGA-vvcf-pv38-hpr3CGA-w8f4-vgvj-89wrCGA-wgrq-wc87-cprqCGA-x89v-27g5-h46c
Published 21-07-2026Last modified 22-07-2026
Vulnerability summary
CVE-2026-16441 is a critical (CVSS 9.6) vulnerability in eclipse foundation openj9. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 43.9% of scored vulnerabilities.
CVSS score
9.6/10
010
Critical · v3.1 (NVD)EPSS score
0.53%
0%100%
Low · +0.25 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 9 · Related 8Timeline
- 21-07-2026PublishedVulnerability first disclosed.
- 22-07-2026Last modifiedVulnerability information updated.
Description
In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method.
CVSS metrics
4 scores · 3 sources · 2 versionsMedium 6.9Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:L/SC:L/SI:H/SA:NSourcesAll 3 agree
- OSV · ChainguardEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:L/SC:L/SI:H/SA:N
- NVDNIST6.9MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:L/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Critical 9.6Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HSourcesSingle source
EPSS trend
Probability
0.53%
Chance of exploitation in the next 30 days
Percentile
44%
Versus all other CVEs
30-day change
+0.25 pp
From 0.28% on 20-09-2026
20-09-202620-10-2026
EPSS score0.53%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard39 products
- openjdk-11-openj9< 0.60.0-r0
- openjdk-11-openj9-dbg< 0.60.0-r0
- openjdk-11-openj9-default-jdk< 0.60.0-r0
- openjdk-11-openj9-default-jvm< 0.60.0-r0
- openjdk-11-openj9-doc< 0.60.0-r0
Eclipse1 product
- openj9≥ 0.8.0, < 0.60.0
Eclipse foundation1 product
- openj9≥ 0.8.0, < 0.60.0
3 vendors · 41 products
