CVE-2026-91461 in Java SE
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Java Secure Socket Extension, commonly referred to as JSSE, which is a core component of Oracle Java SE and its associated distributions including Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition. This security flaw affects specific supported versions such as Oracle Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, and 25.0.4.1, alongside corresponding GraalVM releases. The JSSE library is responsible for implementing the Transport Layer Security protocol and Secure Sockets Layer protocols, handling encryption, decryption, authentication, and data integrity during network communications. A defect in this component allows an unauthenticated attacker with network access to compromise the underlying Java runtime environment by exploiting difficulties inherent in the TLS handshake or subsequent secure channel operations. The vulnerability is characterized as difficult to exploit due to high complexity requirements for successful exploitation, yet it poses a significant risk because it does not require user interaction or authentication credentials prior to execution.
The operational impact of this vulnerability centers on integrity violations rather than confidentiality breaches or availability disruptions. Successful exploitation enables an attacker to perform unauthorized updates, inserts, or deletes against data accessible by the affected Java applications. This capability aligns with CWE-354, which describes improper validation of consistency within a database or storage system, and potentially CWE-269 regarding elevation of privilege if the compromised application has elevated permissions. The attack vector is strictly network-based via TLS connections, meaning remote attackers can target systems over local area networks or the internet without needing physical access or prior authentication. However, it is critical to note that this vulnerability cannot be triggered through untrusted Java Web Start applications or untrusted Java applets. Instead, exploitation requires supplying malicious data directly to APIs within the JSSE component, such as those invoked by web services or other server-side network interactions. This constraint limits the attack surface primarily to backend systems and API endpoints rather than client-facing browser-based deployments.
From a threat intelligence perspective, this vulnerability maps to MITRE ATT&CK techniques involving remote code execution or data manipulation via protocol exploitation. Specifically, it relates to tactics focused on Impact where adversaries seek to modify system state or exfiltrate information through integrity compromises. The CVSS 3.1 base score of 3.7 reflects the low severity due to high attack complexity and lack of impact on confidentiality or availability, but the potential for data corruption remains a serious concern for enterprise environments relying on these Java versions for critical business logic. Organizations must assess their exposure by identifying any services that utilize JSSE APIs directly over TLS without proper input validation mechanisms in place.
Mitigation strategies should prioritize immediate patching to the latest available version of Oracle Java SE, GraalVM for JDK, or GraalVM Enterprise Edition as specified in vendor advisories. Since exploitation requires direct API interaction via network connections, implementing strict input validation and sanitization at the application layer can reduce risk even before patches are applied. Additionally, deploying web application firewalls with TLS inspection capabilities may help detect anomalous traffic patterns associated with this exploit attempt. Network segmentation should be enforced to limit access to systems running vulnerable Java versions, ensuring that only trusted internal services can initiate connections using JSSE components. Regular security audits and penetration testing focused on API endpoints are recommended to verify the effectiveness of these controls and identify any residual exposure in production environments.