CVE-2026-91396 in GraalVM Enterprise Edition
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Utility component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition, affecting specific supported versions including Oracle Java SE 8u503, 8u503-perf, and 11.0.32.1, as well as Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1, and Oracle GraalVM Enterprise Edition 21.3.19.1.1. This flaw represents a significant security risk because it allows an unauthenticated attacker with network access via multiple protocols to compromise the integrity and availability of these Java environments. The vulnerability is characterized by its ease of exploitation, meaning that attackers do not require complex conditions or user interaction to trigger the exploit. Instead, they can leverage APIs within the specified component, such as through a web service supplying data directly to these APIs, to execute malicious actions against the target system. This accessibility makes it particularly dangerous in enterprise environments where Java services are exposed over networks without strict input validation mechanisms.
The technical nature of this flaw centers on improper handling of user-supplied input within the Utility component's API layer. When untrusted code or data is processed by these APIs, the lack of sufficient sanitization allows an attacker to manipulate internal states or database operations associated with the Java runtime environment. This leads directly to unauthorized update, insert, or delete access to accessible data managed by Oracle Java SE and its related GraalVM variants. Furthermore, the vulnerability enables a partial denial of service condition, where successful exploitation can degrade system performance or render specific services unavailable to legitimate users. The impact is compounded in deployments that rely on the Java sandbox for security, such as clients running sandboxed Java Web Start applications or sandboxed Java applets. In these scenarios, if untrusted code from the internet loads and executes within this vulnerable component, it can bypass expected isolation boundaries due to the flaw in the underlying utility functions, leading to data integrity violations and service disruptions that extend beyond typical sandbox limitations.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the core issue stems from the failure to adequately validate or sanitize inputs received via network protocols before processing them within critical API endpoints. The ability of an unauthenticated attacker to modify data corresponds closely to CWE-74 Injection in contexts where database operations are involved, although the primary vector is through application logic rather than direct SQL injection. In terms of offensive security frameworks, this vulnerability maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter if the exploitation leads to further code execution, but more accurately reflects T1486 Data Encrypted for Impact in cases where availability is targeted via denial-of-service mechanisms, or T1078 Valid Accounts if authentication bypasses are involved. However, given the unauthenticated nature described, it primarily represents a remote code execution precursor that facilitates data manipulation and service degradation without prior credential compromise.
The operational impact of this vulnerability is substantial for organizations relying on Oracle Java SE and GraalVM products for critical business applications. The potential for unauthorized data modification poses severe risks to data integrity, potentially leading to financial loss, regulatory non-compliance, or reputational damage depending on the nature of the affected data. Additionally, the partial denial of service capability disrupts operational continuity, causing downtime that can affect customer-facing services and internal workflows. Because the vulnerability affects multiple protocols and allows exploitation via network access, it is particularly relevant for internet-facing applications using Java backends. The inclusion of GraalVM versions indicates that modern polyglot environments utilizing native image compilation or advanced runtime optimizations are also susceptible, expanding the attack surface beyond traditional JVM-based deployments to include high-performance computing contexts where these utilities are frequently employed.
Mitigation strategies must prioritize immediate patching and rigorous input validation practices. Organizations should apply the latest security updates provided by Oracle for all affected versions of Java SE and GraalVM as soon as possible. For environments that cannot be patched immediately, network-level controls such as firewalls or web application firewalls can help mitigate risk by filtering out malformed requests targeting the vulnerable utility APIs. Implementing strict input validation on any data passed to these components is essential; developers should ensure that all inputs are sanitized against known injection patterns and type constraints before processing. Additionally, reducing the attack surface by disabling unnecessary network protocols or restricting API access to authenticated users only can significantly lower exposure. For deployments involving sandboxed applets or Web Start applications, it is crucial to review security policies to ensure they do not inadvertently grant excessive privileges that could be exploited through this flaw. Regular vulnerability scanning and penetration testing focused on Java-based services will help identify similar weaknesses in custom implementations of these utilities before they can be leveraged by adversaries.