CVE-2026-91403 in Java SE
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Java Secure Socket Extension, commonly referred to as JSSE, a core component of Oracle Java SE and related distributions such as Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition. This security flaw affects multiple supported versions including Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, and 25.0.5, as well as specific releases of GraalVM products. The vulnerability is characterized by an easily exploitable condition that permits unauthenticated attackers to compromise the integrity and confidentiality of data processed through these Java environments. Because JSSE handles cryptographic operations and secure communications over networks, flaws within this component can have severe implications for any application relying on it for encrypted data exchange or authentication processes.
The technical nature of this flaw allows an attacker with network access via multiple protocols to exploit the vulnerability without requiring prior authentication. This lack of required credentials significantly lowers the barrier to entry for malicious actors, enabling remote exploitation over standard network connections. The attack vector is broad, suggesting that the defect may be triggered through various communication channels supported by JSSE, such as HTTPS, TLS, or other secure socket-based protocols. The ability to exploit this vulnerability via APIs further expands the risk surface, particularly in scenarios where web services supply data directly to these Java components. This means that applications consuming external data streams are at heightened risk if they do not properly validate input before passing it to vulnerable JSSE functions.
The operational impact of a successful exploitation is substantial, resulting in unauthorized creation, deletion, or modification of critical data within the affected systems. Furthermore, attackers can gain complete access to all Oracle Java SE accessible data, effectively breaking confidentiality guarantees. This aligns with high-severity classifications where both confidentiality and integrity impacts are severe while availability remains unaffected according to the provided CVSS metrics. The vulnerability is particularly dangerous in deployments involving sandboxed environments, such as Java Web Start applications or Java applets that load untrusted code from the internet. In these contexts, the application relies heavily on the Java sandbox for security isolation; however, this flaw allows malicious code to bypass expected restrictions and access sensitive data that should remain protected by the sandbox boundary.
From a classification perspective, this vulnerability corresponds closely with CWE-20 Improper Input Validation or potentially CWE-787 Out-of-bounds Write depending on the specific memory corruption mechanism involved in the JSSE implementation flaws. The attack pattern is consistent with ATT&CK technique T1190 Exploit Public-Facing Application, as it targets a component exposed to network traffic and allows unauthenticated access. The high base score of 9.1 reflects the critical nature of the issue due to its remote exploitability and lack of authentication requirements. Organizations running affected versions must recognize that even sandboxed applications are not immune if they process external data through vulnerable JSSE pathways, as the underlying library flaw can be triggered regardless of the application's intended security posture.
Mitigation strategies require immediate attention from system administrators and development teams responsible for maintaining these Java environments. The primary remediation step is to apply the latest security patches provided by Oracle for all affected versions listed in the advisory. For organizations unable to patch immediately, network-level controls such as strict firewall rules limiting access to ports associated with vulnerable services can reduce exposure. Additionally, implementing input validation at the application layer before data reaches JSSE APIs may provide a temporary defense-in-depth measure against malformed or malicious inputs designed to trigger the flaw. It is also advisable to review Java security policies and sandbox configurations to ensure that untrusted code execution is minimized where possible, although reliance on patching remains the most effective long-term solution given the depth of access granted by this vulnerability.