How severe is CVE-2026-16441?

CVE-2026-16441 has a CVSS 3.x base score of 9.6, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-16441 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (22nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-16441?

CVE-2026-16441 affects Eclipse Openj9. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-16441?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2026-16441 published?

CVE-2026-16441 was published on 2026-07-21 and last updated on 2026-08-18.

CVE-2026-16441

CVE-2026-16441 is a critical-severity vulnerability in Eclipse Openj9 with a CVSS 3.x base score of 9.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-758.

Key facts

Severity: Critical (CVSS 3.x base score 9.6)
CVSS v4: 6.9
EPSS exploit prediction: 0% (22nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-758
Affected product: Eclipse Openj9
Published: 2026-07-21
Last modified: 2026-08-18

Description

In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method.

Frequently asked questions

What is CVE-2026-16441?: In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method.
How severe is CVE-2026-16441?: CVE-2026-16441 has a CVSS 3.x base score of 9.6, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-16441 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (22nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-16441?: CVE-2026-16441 affects Eclipse Openj9. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-16441?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2026-16441 published?: CVE-2026-16441 was published on 2026-07-21 and last updated on 2026-08-18.

References

Affected products (1)

cpe:2.3:a:eclipse:openj9:*:*:*:*:*:*:*:*

More vulnerabilities in Eclipse Openj9

CVE-2021-41035 — Critical (CVSS 9.8): In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke…
CVE-2020-27221 — Critical (CVSS 9.8): In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the…
CVE-2019-11772 — Critical (CVSS 9.8): In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided…
CVE-2018-12549 — Critical (CVSS 9.8): In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of…
CVE-2018-12547 — Critical (CVSS 9.8): In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the…
CVE-2018-12548 — Critical (CVSS 9.8): In OpenJDK + Eclipse OpenJ9 version 0.11.0 builds, the public jdk.crypto.jniprovider.NativeCrypto class contains public…

All CVEs affecting Eclipse Openj9 →

Other CWE-758 vulnerabilities

CVE-2026-4705 — Critical (CVSS 9.8): Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9,…
CVE-2026-4724 — Critical (CVSS 9.1): Undefined behavior in the Audio/Video component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
CVE-2026-4718 — High (CVSS 8.1): Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9,…
CVE-2025-54811 — High (CVSS 7.1): OpenPLC_V3 has a vulnerability in the enipThread function that occurs due to the lack of a return value. This leads to…
CVE-2024-4774 — Medium (CVSS 6.5): The `ShmemCharMapHashEntry()` code was susceptible to potentially undefined behavior by bypassing the move semantics…
CVE-2026-34549 — Medium (CVSS 6.2): iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6,…

Browse all CWE-758 vulnerabilities →