CVE-2026-91451 in Java SE
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Networking component of Oracle Java SE and its associated distributions, including specific releases of Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition. Affected versions span a wide range of supported updates, specifically 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, and 25.0.4.1 for Oracle Java SE, alongside versions 17.0.20.1 and 21.0.12.1 for GraalVM JDK, and version 21.3.19.1.1 for GraalVM Enterprise Edition. This flaw represents a significant security risk because it allows an unauthenticated attacker to compromise the integrity of data accessible through Oracle Java SE applications. The vulnerability is characterized by its ease of exploitation, requiring only network access via multiple protocols and no prior authentication or user interaction from the victim side.
The technical nature of this flaw centers on improper input validation within the networking layer of the Java runtime environment. An attacker can exploit this weakness by supplying maliciously crafted data directly to specific APIs exposed by the affected component. It is critical to note that exploitation does not rely on traditional attack vectors such as untrusted Java Web Start applications or untrusted Java applets, which are often sandboxed and restricted in modern environments. Instead, the vulnerability is triggered through direct API interactions, potentially via web services or other network-facing interfaces that invoke these specific networking functions. This distinction highlights a flaw in how the runtime handles external data inputs at the protocol level rather than within application-level security boundaries like applet sandboxes.
The operational impact of this vulnerability is primarily focused on integrity violations. Successful exploitation enables an attacker to perform unauthorized updates, inserts, or deletes against accessible data managed by Oracle Java SE applications. This aligns with the Common Weakness Enumeration (CWE) classification for improper input validation and subsequent data manipulation attacks. The CVSS 3.1 base score of 5.3 reflects a medium severity level, driven largely by the integrity impact while maintaining low availability and confidentiality impacts in this specific context. The attack vector is classified as network-accessible with low complexity and no required privileges or user interaction, indicating that automated tools could potentially discover and exploit this flaw against vulnerable systems exposed to untrusted networks.
From a threat intelligence perspective, this vulnerability maps to ATT&CK techniques involving data injection and manipulation through API abuse. Attackers leveraging this flaw would likely engage in remote code execution precursors by corrupting application state or database contents, which can lead to further lateral movement or persistent access depending on the privileges of the Java process. The ability to modify data without authentication undermines the trust model of many enterprise applications that rely on Java for backend services and API gateways.
Mitigation strategies must prioritize immediate patching to the latest available versions provided by Oracle, as these updates contain fixes for the underlying input validation logic in the networking component. Organizations should also implement network segmentation to restrict access to systems running vulnerable Java versions from untrusted networks. Additionally, deploying web application firewalls or API gateways with strict schema validation can help detect and block malformed requests targeting the affected APIs before they reach the runtime environment. Regular auditing of external-facing services for proper input sanitization is essential to prevent similar exploitation vectors in other components.