How severe is CVE-2021-41035?

CVE-2021-41035 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2021-41035 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (77th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-41035?

CVE-2021-41035 affects Eclipse Openj9. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2021-41035?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2021-41035 published?

CVE-2021-41035 was published on 2021-10-25 and last updated on 2026-06-17.

CVE-2021-41035

CVE-2021-41035 is a critical-severity vulnerability in Eclipse Openj9 with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-250.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 7.5
EPSS exploit prediction: 2% (77th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-250
Affected product: Eclipse Openj9
Published: 2021-10-25
Last modified: 2026-06-17

Description

In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods.

Frequently asked questions

What is CVE-2021-41035?: In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods.
How severe is CVE-2021-41035?: CVE-2021-41035 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2021-41035 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (77th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-41035?: CVE-2021-41035 affects Eclipse Openj9. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2021-41035?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2021-41035 published?: CVE-2021-41035 was published on 2021-10-25 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:eclipse:openj9:*:*:*:*:*:*:*:*

More vulnerabilities in Eclipse Openj9

CVE-2020-27221 — Critical (CVSS 9.8): In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the…
CVE-2019-11772 — Critical (CVSS 9.8): In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided…
CVE-2018-12549 — Critical (CVSS 9.8): In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of…
CVE-2018-12547 — Critical (CVSS 9.8): In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the…
CVE-2018-12548 — Critical (CVSS 9.8): In OpenJDK + Eclipse OpenJ9 version 0.11.0 builds, the public jdk.crypto.jniprovider.NativeCrypto class contains public…
CVE-2026-16441 — Critical (CVSS 9.6): In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has…

All CVEs affecting Eclipse Openj9 →

Other CWE-250 vulnerabilities

CVE-2026-4606 — Critical (CVSS 10.0): GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing…
CVE-2022-2634 — Critical (CVSS 10.0): An attacker may be able to execute malicious actions due to the lack of device access protections and device…
CVE-2026-70496 — Critical (CVSS 9.9): A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster…
CVE-2026-72508 — Critical (CVSS 9.9): A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM).…
CVE-2026-48584 — Critical (CVSS 9.9): Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate privileges over a…
CVE-2026-50566 — Critical (CVSS 9.9): Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and…

Browse all CWE-250 vulnerabilities →