CVE-2026-91380 in Java SE
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the Utility component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products. This flaw affects a specific range of supported versions including Oracle Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, and 25.0.4.1, as well as Oracle GraalVM for JDK versions 17.0.20.1 and 21.0.12.1, and Oracle GraalVM Enterprise Edition version 21.3.19.1.1. The core technical issue is characterized by a difficult-to-exploit vulnerability that permits an unauthenticated attacker to compromise the integrity of these Java environments. Crucially, exploitation requires the attacker to have logon access to the infrastructure where the affected software executes. This prerequisite significantly limits the attack surface compared to remote code execution vulnerabilities but still poses a serious risk in environments with loose internal network security or compromised host credentials.
The operational impact of this vulnerability centers on unauthorized modifications and disclosures within the Java environment's accessible data. Successful exploitation allows an attacker to perform unauthorized updates, inserts, or deletes against certain data accessible by Oracle Java SE, GraalVM for JDK, or GraalVM Enterprise Edition. Additionally, it grants unauthorized read access to a subset of such data. This aligns with CWE-798, which covers the use of hardcoded credentials or improper authentication mechanisms that lead to privilege escalation or data exposure when combined with other flaws. The vulnerability can be exploited through APIs within the specified component, particularly via web services that supply data to these APIs. This indicates a potential weakness in how input validation and access controls are implemented for API endpoints interacting with the utility functions of the Java runtime.
The risk extends beyond standard server-side deployments to include client-side scenarios involving sandboxed applications. The vulnerability applies to Java deployments where clients run sandboxed Java Web Start applications or sandboxed Java applets that load and execute untrusted code from external sources like the internet. In these contexts, attackers rely on the Java sandbox for security isolation; however, this flaw may allow malicious code running within a seemingly secure sandbox context to bypass expected restrictions due to improper handling of data supplied through APIs. This scenario is particularly dangerous as it targets end-users who trust the integrity of their local execution environment while interacting with potentially hostile remote services.
From an industry standard perspective, this vulnerability maps to ATT&CK technique T1059, specifically Command and Scripting Interpreter sub-techniques if code execution leads to further system interaction, or more accurately T1213 Data from Information Repositories for the data access aspects. The CVSS 3.1 base score of 4.0 reflects a low severity rating primarily due to the high attack complexity (AC:H) and local availability requirement (AV:L), despite having no authentication required (PR:N). The vector string AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N confirms that while confidentiality and integrity impacts are present, there is no direct impact on system availability. Mitigation strategies should focus on applying the latest security patches provided by Oracle for all affected versions. Furthermore, organizations must enforce strict network segmentation to limit logon access to infrastructure running these Java components. For client-side deployments, it is critical to review and restrict permissions granted to sandboxed applications and ensure that web services interacting with Java APIs implement robust input validation and authentication mechanisms to prevent exploitation through data supply channels.