CVE-2026-91374 in Java SE
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serviceability). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Serviceability component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products. This flaw affects a specific range of supported versions including Oracle Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, and 25.0.4.1, as well as Oracle GraalVM for JDK versions 17.0.20.1 and 21.0.12.1, and Oracle GraalVM Enterprise Edition version 21.3.19.1.1. The Serviceability subsystem is critical for monitoring, debugging, and managing Java applications in production environments. A defect within this component allows an unauthenticated attacker to compromise the integrity and confidentiality of data accessible by these platforms. The vulnerability is characterized as difficult to exploit due to high complexity requirements, yet it remains significant because it does not require user interaction or authentication from a network perspective.
The technical nature of this flaw involves unauthorized access capabilities that manifest through multiple protocols available via APIs within the Serviceability component. Attackers can leverage web services supplying data to these APIs to trigger the vulnerability remotely over networks such as HTTP, HTTPS, RMI, JMX, and other standard Java connectivity mechanisms. The core issue likely stems from insufficient validation or improper handling of input data processed by serviceability tools like JConsole, VisualVM, or internal diagnostic interfaces. When an attacker successfully exploits this condition, they gain the ability to perform unauthorized updates, inserts, or deletes against accessible data stores managed by the JVM. Additionally, there is a risk of unauthorized read access to a subset of sensitive information held within the Java environment's memory space or associated storage mechanisms.
From an operational impact standpoint, this vulnerability poses a moderate but serious threat primarily affecting confidentiality and integrity rather than availability. The CVSS 3.1 base score of 4.8 reflects these impacts with vector components indicating network accessibility, high attack complexity, no required privileges, no user interaction, and unchanged scope. Unauthorized data modification can lead to application logic errors, corrupted state persistence, or injection attacks if the compromised data is subsequently processed by other system components. Data exfiltration risks are present as attackers may retrieve sensitive configuration details, session tokens, or internal application states that were not intended for external exposure. This risk extends particularly to Java deployments where clients run sandboxed applications such as Java Web Start apps or applets loading untrusted code from the internet. These environments rely heavily on the Java security manager and sandboxing mechanisms; however, if the underlying serviceability layer is compromised, it may bypass expected isolation boundaries allowing malicious code to interact with privileged internal APIs directly.
Mitigation strategies must prioritize immediate patching of all affected Oracle Java SE, GraalVM for JDK, and Enterprise Edition versions to their latest secure releases provided by Oracle. Organizations should review their network architecture to restrict access to JMX ports and other serviceability interfaces from untrusted networks using firewalls or reverse proxies that enforce strict authentication policies even if the underlying vulnerability exists. Disabling unnecessary remote debugging features in production environments reduces the attack surface significantly. For deployments involving applets or Web Start applications, ensuring that security managers are properly configured with restrictive permissions can help limit the damage an attacker might achieve through this specific vector. Continuous monitoring of serviceability logs for anomalous API calls and regular vulnerability scanning against known CVEs remain essential practices to detect potential exploitation attempts early in the kill chain.