CVE-2026-91484 in Java SE
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle Java SE (component: Java plugin). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE. While the vulnerability is in Oracle Java SE, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Java plugin component of Oracle Java SE, specifically affecting versions 8u503 and 8u503-perf. This flaw represents a significant security risk for environments where Java applets or Web Start applications are deployed to end-user clients. The core issue stems from how the Java sandbox handles untrusted code loaded from external sources such as the internet. In these client-side deployments, the application relies heavily on the sandboxing mechanism to isolate potentially malicious code and prevent it from accessing sensitive system resources. However, a flaw in this isolation logic allows for an escape or bypass of standard security controls, leading to unauthorized access beyond the intended boundaries of the Java runtime environment.
Exploitation of this vulnerability requires specific conditions that limit its immediate threat level but do not eliminate the risk entirely. An attacker must possess low privileges on the infrastructure where Oracle Java SE is executing and have valid logon credentials to interact with the system. Furthermore, while the description notes it is difficult to exploit due to high complexity requirements, successful exploitation does not require user interaction in terms of clicking or triggering a specific UI element, as indicated by the User Interface parameter being set to None in the CVSS vector. This means that once an attacker gains low-level access and can trigger the execution of malicious Java code within this context, they may leverage the flaw to compromise the integrity and confidentiality of the system without further user involvement.
The operational impact of a successful exploit is severe, particularly regarding data security. The vulnerability allows for unauthorized creation, deletion, or modification of critical data accessible by Oracle Java SE. More critically, it grants complete access to all such data, effectively breaking down the privacy barriers intended by the sandbox model. This scope change implies that while the technical flaw is localized within the Java component, the consequences ripple out to impact additional products and services running on the same infrastructure. Attackers can exfiltrate sensitive information or alter critical datasets, leading to potential business disruption, regulatory non-compliance, and loss of trust in the affected systems.
From a classification perspective, this vulnerability aligns with CWE-250, which denotes execution with unnecessary privileges, as well as CWE-94, involving improper control of generation of code (code injection), depending on the specific mechanism used to bypass the sandbox. In terms of offensive security frameworks like MITRE ATT&CK, this behavior is consistent with techniques related to privilege escalation and data exfiltration from local systems. The high confidentiality and integrity impacts reflected in the CVSS 3.1 base score of 7.5 underscore the critical nature of addressing this issue for any organization relying on Java applets or Web Start applications for client-side operations.
Mitigation strategies must focus on both immediate remediation and long-term architectural changes. Oracle has released patches for versions 8u503 and 8u503-perf, which should be applied immediately to all affected systems. Organizations should audit their Java deployments to identify any remaining instances of these vulnerable versions. Beyond patching, it is crucial to review the deployment model; since this vulnerability specifically targets client-side sandboxed environments loading untrusted code, migrating away from legacy applets and Web Start applications toward modern web standards or server-side processing can eliminate the attack surface entirely. Additionally, enforcing strict network segmentation and applying least-privilege principles for user accounts running Java applications will reduce the likelihood of an attacker achieving the initial low-level access required to trigger this flaw.