CVE-2026-91385 in GraalVM Enterprise Edition
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and 27; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the JavaFX component of Oracle Java SE, Oracle JavaFX, and Oracle GraalVM Enterprise Edition products. This security flaw affects specific supported versions including Oracle Java SE 8u503, Oracle JavaFX versions 21.0.12, 25.0.4, and 27, as well as Oracle GraalVM Enterprise Edition version 21.3.19.1.1. The core issue stems from a design flaw or implementation error within the Java runtime environment that permits an unauthenticated attacker to exploit the system via network access through multiple protocols. This vulnerability is particularly relevant for client-side deployments where applications operate under sandboxed environments, such as Java Web Start applications and Java applets. These environments are designed to restrict potentially harmful code by isolating it from critical system resources. However, in this instance, the isolation mechanisms fail when processing untrusted code loaded from external sources like the internet. It is crucial to note that this vulnerability does not impact server-side deployments where only trusted code installed by an administrator is executed, thereby limiting the scope of risk primarily to end-user client applications rather than backend infrastructure services.
The operational mechanics of this exploit require human interaction from a user other than the attacker, which classifies it under social engineering vectors or requires the victim to initiate an action that triggers the malicious payload execution within the Java sandbox. Despite this requirement for user engagement, the ease of exploitation remains high due to low attack complexity and network accessibility without prior authentication. Once triggered, the vulnerability allows unauthorized operations on data accessible by the compromised application. Specifically, attackers can achieve unauthorized update, insert, or delete access to certain datasets managed by the affected components. Additionally, there is a risk of unauthorized read access to a subset of accessible data, leading to potential information disclosure. The impact assessment indicates moderate severity with a CVSS 3.1 base score of 5.4, reflecting balanced impacts on confidentiality and integrity while maintaining no direct effect on availability. This scoring aligns with Common Weakness Enumeration categories such as CWE-20 Improper Input Validation or CWE-787 Out-of-bounds Write depending on the specific internal trigger mechanism, though the primary classification often relates to improper handling of untrusted data in sandboxed contexts.
From a threat intelligence perspective, this vulnerability maps to MITRE ATT&CK techniques involving initial access and execution phases where attackers leverage trusted applications like Java applets or Web Start launchers to bypass security controls. The reliance on human interaction suggests tactics consistent with spear-phishing or drive-by download scenarios where users are tricked into running maliciously crafted content that exploits the Java runtime's parsing logic. To mitigate these risks, organizations should ensure all affected versions of Oracle Java SE, JavaFX, and GraalVM Enterprise Edition are updated to their latest patched releases provided by Oracle. For environments unable to patch immediately due to legacy application dependencies, implementing strict network segmentation can limit lateral movement if an endpoint is compromised. Furthermore, enforcing policies that restrict the execution of unsigned or untrusted applets and Web Start applications significantly reduces the attack surface. Security administrators should also consider disabling Java in web browsers where it is not strictly necessary for business operations, as modern web standards have largely replaced these technologies with safer alternatives like HTML5 and JavaScript sandboxing mechanisms which offer more granular control over resource access without requiring a full virtual machine runtime that may contain such deep-seated vulnerabilities.