CVE-2026-91403: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete

This vulnerability affects Oracle Java SE versions 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK versions 17.0.21 and 21.0.13; and Oracle GraalVM Enterprise Edition version 21.3.20. It resides in the JSSE component and is exploitable remotely without authentication via multiple protocols. Successful exploitation allows an attacker to gain unauthorized creation, deletion, or modification access to critical data or complete access to all data accessible by these products. The vulnerability can be triggered through APIs, including web services, and affects Java clients running sandboxed applications that load untrusted code relying on the Java sandbox for security. Oracle has released security patches for supported versions under Premier or Extended Support, and recommends upgrading to supported versions to receive patches. The vulnerability has a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

An unauthenticated attacker with network access can remotely exploit this vulnerability to gain unauthorized creation, deletion, or modification access to critical data or all accessible data within the affected Oracle Java SE and GraalVM products. This compromises confidentiality and integrity of data but does not impact availability. The vulnerability affects multiple protocols and can be exploited through APIs or sandboxed Java applications that load untrusted code. This can lead to complete unauthorized access to critical data.

Oracle has released security patches for the affected versions under Premier or Extended Support. Customers should apply the patches provided in the Oracle Security Alert for CVE-2026-91403. Oracle recommends upgrading to supported versions to ensure patch availability. No indication is given that no action is required or that the vulnerability is already mitigated. Therefore, applying the official patches is the recommended mitigation.