CVE-2026-16441

CriticalCVSS 9.6/10Last modified Oct 24, 2026

Description

In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-758

Affected software

Vendor	Product	Versions
Eclipse Foundation	OpenJ9	>= 0.8.0, < 0.60.0

References

https://github.com/eclipse-openj9/openj9/pull/24396Issue Tracking, Patch
https://github.com/eclipse-openj9/openj9/security/advisories/GHSA-hcfc-9hjx-2q7fBroken Link
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/194Broken Link

Timeline

Published: Jul 21, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-164429.8A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue oc CVE-2026-164439.1A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokeri CVE-2026-164447.5Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.81.5 allows an authenticated remote sessi CVE-2026-164457.5A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP opt CVE-2026-164477.3A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /web/jquery/uploader/multi_uploadify.php CVE-2026-164486.3A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326,CVE-2026-164496.3A vulnerability was determined in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The impacted element is the function CVE-2026-16454.4The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_currency' parameter and the 'locale_url' settin CVE-2026-164504.3A vulnerability was identified in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This affects the function getTenantId CVE-2026-164516.3A security flaw has been discovered in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This impacts an unknown function CVE-2026-164537.1Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayS CVE-2026-164544.3In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Devi