CVE-2026-91375 in GraalVM Enterprise Edition
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/24/2026
The identified vulnerability resides within the Libraries component of Oracle Java SE and related distributions including Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition, affecting specific supported versions such as 8u503-perf through to version 27. This flaw represents a significant integrity risk that allows an unauthenticated attacker with local network access or logon capabilities on the infrastructure hosting Java SE to compromise the system. The attack vector is classified as Local (AV:L) in CVSS terminology, indicating that physical or logical proximity to the target machine is required for exploitation attempts. Despite this constraint, the vulnerability remains particularly dangerous because it does not require prior authentication credentials within the Java environment itself, relying instead on network-level access or local shell access to initiate the attack sequence.
The technical nature of this flaw involves a difficult-to-exploit condition that necessitates human interaction from a victim other than the attacker. This social engineering aspect is critical to the success of the exploit, as it aligns with ATT&CK techniques involving user execution and potentially drive-by compromise scenarios where unsuspecting users are tricked into performing actions that trigger the vulnerability. The exploitation mechanism leverages specific APIs within the affected component, often through web services or applications that supply data directly to these interfaces. This suggests a flaw in how input validation is performed on external data sources before they are processed by core Java libraries, allowing maliciously crafted inputs to manipulate internal state or logic flows in unintended ways.
The operational impact of this vulnerability centers heavily on integrity violations rather than confidentiality breaches or availability disruptions. Successful exploitation results in unauthorized creation, deletion, or modification of critical data accessible to the Oracle Java SE environment. This includes all data that the running application has permission to access, which could range from database records and configuration files to user-generated content stored locally by sandboxed applications. The CVSS 3.1 base score of 4.7 reflects this moderate severity driven primarily by high integrity impact while maintaining low confidentiality and availability impacts. This profile indicates that an attacker aims to alter system state or data rather than steal information or crash the service, which can lead to long-term persistence or corruption of business logic if left unaddressed.
This vulnerability also extends its risk surface to Java deployments in client-side environments, specifically those running sandboxed Java Web Start applications or sandboxed Java applets that load and execute untrusted code from the internet. These scenarios rely on the Java sandbox security model for isolation, but this flaw potentially undermines those boundaries when combined with human interaction elements such as clicking a malicious link or opening a compromised document. The presence of user interface requirements (UI:R) in the CVSS vector underscores that automated remote exploitation is not feasible without some form of social engineering to engage the end-user, yet once triggered, the consequences for data integrity are severe and potentially irreversible depending on the privileges held by the Java process.
Mitigation strategies must focus on immediate patching of all affected Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition versions listed in the advisory. Organizations should prioritize updating to the latest security patches provided by Oracle to close the API-level flaws that enable this integrity compromise. In environments where upgrading is not immediately possible, network segmentation controls can help restrict local access from untrusted networks, reducing the attack surface for attackers who might otherwise gain logon capabilities. Additionally, strict application whitelisting and disabling of legacy Java features such as applets or Web Start in browser contexts can reduce exposure to social engineering vectors that trigger this vulnerability. Security teams should also monitor for anomalous data modification patterns within applications using these libraries, as early detection of integrity violations may indicate an active exploitation attempt before significant damage occurs.