Key points
- CVE-2026-91403 is rated Critical with a CVSS score of 9.1 by the National Vulnerability Database.
- The flaw affects Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition components.
- Attackers need only network access via multiple protocols to exploit the vulnerability without authentication.
The JSSE component in Oracle Java SE contains a critical vulnerability that allows unauthenticated attackers to compromise systems remotely. According to the National Vulnerability Database, this flaw enables unauthorized creation, deletion, or modification of critical data. The vulnerability also permits complete access to all data accessible by the affected Java environments. This exposure affects both server-side deployments and client-side applications relying on the Java sandbox for security.
Developers using Oracle Java SE versions 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5, or 27.0.1 are at risk. Oracle GraalVM for JDK versions 17.0.21 and 21.0.13 are also affected, along with Oracle GraalVM Enterprise Edition 21.3.20. The National Vulnerability Database notes that the vulnerability is easily exploitable via APIs, such as through web services supplying data to these components.
What we know
The National Vulnerability Database assigns CVE-2026-91403 a CVSS 3.1 Base Score of 9.1, classifying it as Critical. The vector string indicates network access, low complexity, no privileges required, and no user interaction. Impacts include high confidentiality and integrity loss, with no availability impact. The vulnerability applies to Java deployments that load and run untrusted code, such as sandboxed Java Web Start applications or applets from the internet.
Defender's checklist
- Inventory all systems running Oracle Java SE, GraalVM for JDK, or GraalVM Enterprise Edition.
- Verify current versions against the affected list provided by the National Vulnerability Database.
- Identify services exposing JSSE APIs to unauthenticated network traffic.
- Review logs for unusual data creation, deletion, or modification patterns.
What analysts watch for
Teams usually monitor for anomalous network traffic targeting Java services on non-standard ports. Analysts check whether sandboxed applications are attempting to access restricted resources or execute unexpected commands. They examine logs for signs of data exfiltration or unauthorized modification of critical files. Security teams also review API call patterns for deviations from normal behavior, such as unusual data payloads or frequency spikes. This helps identify potential exploitation attempts before significant damage occurs.
What to do and how to stay safe: Oracle Java SE
- Update Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition to versions that address CVE-2026-91403 once the vendor provides an update.
- Restrict network access to Java services by implementing strict firewall rules and limiting exposure to trusted networks only.
- Enable detailed logging for all Java applications to detect unauthorized data access or modification attempts.
- Isolate systems running vulnerable versions until patches are applied and verified.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Oracle Java SE versions are affected by CVE-2026-91403?
Oracle Java SE versions 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1 are affected.
What is the CVSS score for this vulnerability?
The CVSS 3.1 Base Score is 9.1, rated as Critical by the National Vulnerability Database.
Can this vulnerability be exploited remotely?
Yes, unauthenticated attackers with network access via multiple protocols can exploit this vulnerability.
