CVE-2026-91452 in GraalVM Enterprise Edition
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Networking component of Oracle Java SE, as well as Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition versions including 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27, and their corresponding enterprise variants. This flaw represents a significant integrity risk for applications relying on these Java runtime environments to handle network communications. The vulnerability is characterized by an easily exploitable condition that permits unauthenticated attackers with network access via multiple protocols to compromise the underlying system state. Unlike many high-profile Java vulnerabilities that require user interaction through browser plugins or applets, this specific flaw can be triggered directly by supplying malicious data to APIs within the specified component without the need for Untrusted Java Web Start applications or Untrusted Java applets. This distinction is critical as it lowers the barrier to entry for attackers, allowing exploitation via standard web services and other network-facing interfaces that invoke these vulnerable networking functions.
The operational impact of this vulnerability centers on unauthorized modifications to accessible data within the Oracle Java SE ecosystem. Successful exploitation enables an attacker to perform unauthorized update, insert, or delete operations against data managed by the affected applications. This aligns with CWE-94, which describes Improper Control of Generation of Code (Code Injection), although in this context it manifests as a logic flaw allowing unintended state changes rather than arbitrary code execution. The integrity impact is explicitly rated as Low to Medium depending on the sensitivity of the data involved, but the potential for data corruption or unauthorized modification remains substantial. By manipulating network inputs at the API level, an attacker can alter database records, modify configuration files, or corrupt application-specific data stores that are exposed through these networking endpoints. This type of attack undermines the trustworthiness of the application and can lead to downstream consequences such as financial loss, regulatory non-compliance, or reputational damage depending on the nature of the affected system.
From a threat intelligence perspective, this vulnerability maps closely to MITRE ATT&CK techniques related to Data Injection and potentially Command and Control if used for persistent backdoors via data manipulation. The attack vector is classified as Network with Low Attack Complexity and requires No Privileges or User Interaction, resulting in a CVSS 3.1 Base Score of 5.3. This score reflects the balance between the ease of exploitation and the scope of impact, which is limited to Integrity without affecting Confidentiality or Availability directly. However, integrity violations can often serve as a precursor to more severe attacks, such as privilege escalation if the modified data influences access control decisions within the application logic. The ability to exploit this through multiple protocols suggests that firewalls relying solely on port-based filtering may not be sufficient defenses unless deep packet inspection is employed to validate input against expected schemas and constraints.
Mitigation strategies must prioritize immediate patching of all affected Oracle Java SE, GraalVM for JDK, and Enterprise Edition versions to the latest available security updates provided by Oracle. Organizations should verify their inventory of systems running these specific version numbers and apply patches during scheduled maintenance windows. In environments where immediate patching is not feasible, network-level controls such as Web Application Firewalls (WAFs) can be configured to inspect incoming requests for patterns indicative of this exploitation attempt, particularly focusing on unusual data structures sent to networking APIs. Input validation should also be rigorously enforced at the application layer to ensure that all external inputs are sanitized and validated against strict type and format constraints before being processed by the vulnerable components. Regular security assessments and penetration testing focused on API endpoints can help identify instances where this vulnerability might still exist due to misconfigurations or legacy code paths that were not fully addressed in standard patching procedures.