Oracle Issues Out-of-Band Alert for Critical Java and GraalVM Flaw CVE-2026-91403

Summary

Oracle's Oct. 21, 2026 Security Alert covers an unauthenticated, remotely exploitable JSSE flaw in Java SE and GraalVM. Oracle rates it 9.1 CVSS and recommends patching affected releases.

Key points

Oracle says CVE-2026-91403 can be exploited remotely over multiple protocols without authentication or user interaction.
The JSSE flaw has a CVSS v3.1 score of 9.1, with high confidentiality and integrity impacts and no direct availability impact.
Affected releases include Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, plus specified GraalVM releases.
Oracle issued an out-of-band Security Alert on Oct. 21, 2026, and recommends applying its patches. Unsupported earlier releases were not tested and may also be vulnerable.
Oracle has not disclosed the full exploitation mechanism; the article reports no public proof of concept or campaign-specific indicators, and says the CVE was not in CISA's KEV catalog as of Oct. 22, 2026.
The article recommends inventorying Java runtimes, prioritizing network-exposed services, patching promptly, and using network restrictions and behavioral monitoring as interim safeguards.

Article Details

Vulnerability Types: Remote unauthenticated vulnerability affecting the JSSE component
Severity: Critical (CVSS v3.1: 9.1)
Affected Versions: Oracle Java SE 8u511
Oracle Java SE 8u511-perf
Oracle Java SE 11.0.33
Oracle Java SE 17.0.21
Oracle Java SE 21.0.13
Oracle Java SE 25.0.5
Oracle Java SE 27.0.1
Oracle GraalVM for JDK 17.0.21
Oracle GraalVM for JDK 21.0.13
Oracle GraalVM Enterprise Edition 21.3.20
Exploitation Status: not_reported
Exploit Availability: none_reported
Patch Status: available
Workarounds: Restrict network access to affected services and limit communication to trusted systems.
Apply application-level access controls where feasible.