CVE-2026-91394 in Java SE
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Networking component of Oracle Java SE and Oracle GraalVM for JDK, affecting specific supported versions including 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, as well as corresponding GraalVM releases. This flaw represents a significant security risk due to its potential for unauthorized access to critical data or complete compromise of all accessible information within the Java environment. The vulnerability is characterized by an unauthenticated attacker with network access via multiple protocols being able to exploit difficult-to-exploit conditions to achieve this compromise. Such scenarios often involve APIs in the specified component, such as through web services that supply data directly to these interfaces, highlighting a systemic weakness in how external inputs are processed and validated within the networking stack of the Java runtime environment.
From a technical perspective, the core issue likely involves improper validation or handling of networked input data, which aligns with common patterns found in CWE-20 Improper Input Validation or potentially CWE-787 Out-of-bounds Write if memory corruption is involved, although the specific mechanism is not detailed beyond its impact on confidentiality. The vulnerability allows an attacker to bypass authentication requirements and leverage existing network connectivity to trigger the flaw without user interaction, as indicated by the absence of UI requirement in the CVSS vector. This characteristic places it firmly within the ATT&CK framework under techniques related to Initial Access or Discovery, specifically where attackers exploit service vulnerabilities to gain a foothold or exfiltrate data from systems that are typically protected by sandboxing mechanisms when running untrusted code like Java Web Start applications or applets.
The operational impact of this vulnerability is severe regarding confidentiality, as evidenced by the CVSS 3.1 Base Score of 5.9 with high confidentiality impact and no direct impact on integrity or availability in the base score calculation. However, complete access to all accessible data implies that once exploited, an attacker could potentially read sensitive information stored within the Java application's context, including database credentials, session tokens, or proprietary business logic exposed through networked APIs. For deployments relying on the Java sandbox for security against untrusted code from the internet, this vulnerability undermines a primary defense layer, allowing malicious actors to escape expected isolation boundaries if they can inject crafted payloads via supported protocols. This is particularly dangerous in enterprise environments where legacy applets or Web Start applications may still be deployed despite known risks associated with their execution model.
Mitigation strategies must prioritize immediate patching of all affected Oracle Java SE and GraalVM for JDK versions to the latest available updates provided by Oracle, which typically include fixes for such networking stack vulnerabilities. Organizations should also implement network segmentation to restrict access to systems running vulnerable Java components from untrusted networks, thereby reducing the attack surface exposed to potential exploit attempts. Additionally, deploying web application firewalls with rulesets capable of detecting anomalous patterns in HTTP or other protocol traffic can provide a layer of defense against exploitation attempts targeting these APIs. Security teams should also review and disable any unnecessary network protocols supported by the Java runtime if they are not strictly required for business operations, further minimizing potential vectors for attack while maintaining robust monitoring to detect signs of unauthorized data access or unusual network activity indicative of successful exploitation.