CVE-2026-16441 is a critical (CVSS 9.6) flaw in Eclipse OpenJ9 versions up to 0.60. When a class file has a concrete superclass method that was later recompiled as abstract, the JVM wrongly runs an interface default method instead. Update to a build that carries the fix and read the Eclipse advisory.
What's affected
Eclipse OpenJ9 up to and including version 0.60.
The upstream fix, "Fix invokeinterface IllegalAccessError handling", was merged into the v0.60.0-release branch on 21 July 2026 as pull request 24396, ported from an earlier change on the main branch. Eclipse also published a GitHub security advisory for this issue. The pages we could read do not give a released version number, so check the advisory or your JDK vendor for the first fixed build.
How to check if you're exposed
Check which JVM you run.
java -version
OpenJ9 builds identify themselves in the output. HotSpot builds are not in scope.
Next, ask where class files come from. The weakness needs a class whose superclass method changed from concrete to abstract after other code was compiled against it. That usually means mixed library versions on one classpath, or plugins and dynamically loaded classes that you do not compile together. Your dependency inventory is the quickest way to find library version mismatches.
What to do now
- Inventory every OpenJ9 runtime, including JVMs bundled inside vendor products and container images.
- Upgrade to an OpenJ9 build that includes pull request 24396, confirming the version in the Eclipse advisory.
- Stop loading untrusted or third party class files into an affected JVM until the upgrade is done.
- Rebuild and redeploy images, then scan them to confirm the old JVM layer is gone.
Why it matters
The weakness is CWE-758 (Reliance on Undefined, Unspecified, or Implementation-Defined Behavior): the JVM behaved in a way the Java specification does not intend when a method changed shape between compile time and run time. Under the specification, a call like this should end in an error. The affected OpenJ9 code instead handed execution to an interface default method.
The vector shows the scope as changed and impact as high for confidentiality, integrity and availability, with user interaction required. A runtime that dispatches calls differently than the language promises can undermine checks that other code relies on. CISA does not list this CVE as known exploited, and the advisory text we read mentions no exploitation.
Quick check
Do I need recompiled classes in my own code to be affected?
The record describes class files where a superclass method was recompiled as abstract. Treat any JVM that runs mixed or third party class files as in scope until it is updated.
Sources
Last reviewed: 19 October 2026.
