CVE-2026-91332 in Java SE
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Networking component of Oracle Java SE and its associated distributions, including specific versions of Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition. Affected software includes Oracle Java SE 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, as well as GraalVM versions 17.0.20.1, 21.0.12.1, and Enterprise Edition 21.3.19.1.1. This flaw represents a significant security regression in the core networking stack of the Java platform, which serves as the foundation for network communications across millions of enterprise applications. The vulnerability is characterized by its ease of exploitation and broad accessibility, allowing unauthenticated attackers to leverage it over multiple network protocols without requiring user interaction or prior authentication credentials.
The technical nature of this flaw centers on improper validation or handling of data within the networking APIs when processing inputs from external sources. Specifically, the vulnerability can be triggered through web services that supply data directly to these Java APIs. When an application loads and executes untrusted code, such as sandboxed Java Web Start applications or applets retrieved from the internet, it relies on the Java security manager and sandboxing mechanisms to restrict access to sensitive resources. However, this specific flaw bypasses those expected safeguards by allowing maliciously crafted network data to manipulate internal state in a way that leads to unauthorized modifications of accessible data structures. This indicates a failure in boundary checks or type safety enforcement within the networking layer when interacting with external inputs.
The operational impact of exploiting this vulnerability is primarily focused on integrity violations rather than confidentiality breaches or availability disruptions, as reflected by its CVSS 3.1 base score of 5.3 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. Successful exploitation enables an attacker to perform unauthorized update, insert, or delete operations on data accessible to the vulnerable Java application. In enterprise environments where Java applications manage critical business logic, database connections, or configuration states, such integrity compromises can lead to data corruption, incorrect decision-making based on tampered inputs, or further lateral movement within a network if the compromised state allows access to additional resources. The ability to modify data without authentication makes this particularly dangerous in scenarios involving automated services or APIs that do not implement robust input sanitization at higher application layers.
From an industry standards perspective, this vulnerability aligns with CWE-20 Improper Input Validation and potentially CWE-787 Out-of-bounds Write if the memory corruption aspect is involved, though the description emphasizes logical integrity violations over raw buffer overflows. In terms of attack tactics, it maps to ATT&CK technique T1564.003 Hidden Files and Directories or more accurately T1059 Command and Scripting Interpreter if used for further exploitation, but primarily fits within T1190 Exploit Public-Facing Application due to its network accessibility via web services. The reliance on sandboxed environments highlights the risk of escape from restricted execution contexts when underlying platform vulnerabilities are present.
Mitigation strategies must prioritize immediate patching by upgrading Oracle Java SE and GraalVM installations to versions that include the security fix for this networking component flaw. Organizations should also implement strict input validation at the application layer, ensuring that all data received via web services or network protocols is sanitized before being passed to vulnerable APIs. Network segmentation can help limit exposure by restricting access to systems running affected Java versions from untrusted networks. Additionally, deploying intrusion detection systems capable of identifying anomalous patterns in network traffic related to these specific API calls may provide an additional layer of defense while patching efforts are underway. Regular security audits and penetration testing focusing on external-facing APIs that utilize Java networking libraries are recommended to identify similar weaknesses before they can be exploited by malicious actors.