CVE-2026-91333 in Java SE
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Security component of Oracle Java SE, affecting specific supported releases including versions 21.0.12.1, 25.0.4.1, and version 27. This flaw represents a significant security risk as it permits an unauthenticated attacker to compromise the integrity of the system through network access via multiple protocols. The difficulty level associated with exploiting this vulnerability is classified as difficult, indicating that while the attack vector exists, successful exploitation requires specific conditions or sophisticated techniques beyond simple automated scanning. The core technical nature of this flaw allows for unauthorized modifications to data accessible by Oracle Java SE, specifically enabling attackers to perform update, insert, or delete operations on sensitive information without proper authorization.
The operational impact of this vulnerability is primarily centered around integrity violations rather than confidentiality breaches or availability disruptions. As indicated by the CVSS 3.1 base score of 3.7 and its vector components AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, the attack does not result in data disclosure or service denial but directly undermines the trustworthiness of stored information. This type of integrity compromise can lead to severe consequences depending on the application context, such as data corruption, unauthorized state changes, or manipulation of critical business logic that relies on accurate database states. The vulnerability is particularly dangerous because it can be exploited through APIs within the affected component, including scenarios where a web service supplies maliciously crafted data directly to these APIs for processing.
This security flaw also extends its impact to Java deployments in client-side environments, specifically targeting sandboxed Java Web Start applications and sandboxed Java applets that load and execute untrusted code from external sources like the internet. These deployment models rely heavily on the Java sandbox mechanism to isolate potentially harmful code from the host system. However, this vulnerability suggests a bypass or weakness within those security boundaries when interacting with specific APIs, allowing maliciously loaded code to perform unauthorized data modifications despite being confined by standard sandbox restrictions. This highlights a critical intersection between API handling logic and runtime security policies that fails to adequately validate input integrity before execution.
From an industry standards perspective, this vulnerability aligns closely with CWE-269 Improper Privilege Management or potentially CWE-787 Out-of-bounds Write if the mechanism involves memory corruption leading to data modification, though the description emphasizes unauthorized access rather than buffer overflow mechanics specifically. In terms of attack tactics, it maps to MITRE ATT&CK techniques related to Data Manipulation and potentially Initial Access via network services that feed into vulnerable application components. The lack of authentication requirement combined with network accessibility makes this a persistent threat for any organization running these specific Java versions in internet-facing or semi-trusted network zones.
Mitigation strategies must prioritize immediate patching to the latest available security updates provided by Oracle, as version 21.0.12.1 and newer are explicitly listed as affected, implying that earlier patches may not have addressed this specific API-level flaw. For environments where upgrading is temporarily unfeasible, network segmentation should be implemented to restrict access to systems running vulnerable Java versions from untrusted networks. Additionally, strict input validation and sanitization protocols must be enforced at the web service layer before data reaches the susceptible APIs. Security teams should also review deployment configurations for any remaining use of sandboxed applets or Web Start applications that process external data, considering migration away from these legacy technologies toward more secure alternatives like browser-based plugins with stricter security models or native client applications with robust code signing and verification processes.