CVE-2026-91417 in Java SE
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Common Object Request Broker Architecture component of Oracle Java SE and Oracle GraalVM Enterprise Edition, specifically affecting versions 8u503, 8u503-perf, and GraalVM Enterprise Edition 21.3.19.1.1. This security flaw is classified as a denial-of-service vulnerability that allows an unauthenticated attacker to disrupt the availability of the affected software through network-accessible protocols. The core technical issue involves improper handling or validation of input data within the CORBA implementation, which can lead to resource exhaustion or application crashes when maliciously crafted requests are processed by the specified APIs.
Exploitation of this vulnerability requires an unauthenticated attacker with network access who can interact directly with the CORBA interfaces exposed by the service. It is critical to note that this flaw cannot be exploited via traditional attack vectors such as Untrusted Java Web Start applications or Untrusted Java applets, which are increasingly deprecated and restricted in modern environments. Instead, successful exploitation necessitates supplying specially crafted data directly to the APIs within the affected component, typically through web services or other network-based communication channels that utilize CORBA protocols. This constraint limits the attack surface but does not eliminate the risk for systems exposing these specific interfaces to untrusted networks.
The operational impact of a successful exploit is primarily centered on availability rather than confidentiality or integrity. An attacker can cause a partial denial of service, meaning they can degrade performance, induce latency spikes, or temporarily halt processing capabilities without necessarily crashing the entire system permanently. This aligns with the CVSS 3.1 base score of 5.3, which indicates a medium severity level driven by availability impacts. The attack vector is network-based with low complexity and requires no user interaction, making it relatively straightforward for automated tools to detect and exploit if the vulnerable services are accessible from external networks or untrusted internal segments.
From a classification perspective, this vulnerability maps closely to CWE-20 Improper Input Validation, as the root cause lies in the failure of the CORBA component to adequately sanitize or validate incoming data structures before processing them. In terms of offensive security frameworks, it corresponds to ATT&CK technique T1499 Endpoint Denial of Service, specifically under sub-techniques involving resource exhaustion via application layer attacks. Understanding these mappings helps in prioritizing remediation efforts and aligning the fix with broader organizational risk management strategies that track common weakness enumerations and adversary tactics.
Mitigation strategies should focus on immediate patching to the latest supported versions of Oracle Java SE and GraalVM Enterprise Edition, as Oracle typically releases security updates addressing such flaws in its Critical Patch Update cycles. In environments where upgrading is not immediately feasible, network-level controls are essential. Administrators should restrict access to CORBA ports using firewalls or intrusion prevention systems, ensuring that only trusted IP addresses can communicate with the vulnerable services. Additionally, disabling unnecessary CORBA features and interfaces reduces the attack surface significantly. Monitoring for anomalous traffic patterns indicative of denial-of-service attempts, such as unusually high volumes of malformed requests, can also provide early warning signs of exploitation activity.