CVE-2026-91403

CVE Enrichment

CVSS: 9.1 CRITICAL
CISA KEV: Not listed

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 22-Oct-2026 05:16
Last Modified: 22-Oct-2026 05:16

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:N

References

[email protected]

Last enrichment sync: 22-Oct-2026 14:58
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

CVE-2026-91403 (CVSS 9.1) AhnLab Reviews October Breaches and AI-Agent Attacks on Peripheral Systems
Oracle has issued an out-of-band Security Alert addressing CVE-2026-91403, a critical vulnerability affecting Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. Oracle Issues Out-of-Band Alert for Critical Java and GraalVM Flaw CVE-2026-91403
On Wednesday, one day after announcing the CPU, Oracle published a separate advisory and security alert for CVE-2026-91403, which is Java’s (and Oracle’s) response to the eMudhra weak-key incident. Oracle’s October 2026 Patch Update Fixes 1,209 Unique CVEs

CVE (12)

Threat Actors (1)

MITRE ATT&CK (6)

Vendors (4)

Products (22)

Tools (3)

Industries (7)

Countries (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.