CVE-2026-91403 is a critical (CVSS 9.1) vulnerability in the JSSE component of Oracle Java SE and Oracle GraalVM. It lets an unauthenticated remote attacker read or modify critical data.
What Is It
CVE-2026-91403 is a vulnerability in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. Oracle describes it as easily exploitable. An unauthenticated attacker with network access over multiple protocols can use it to compromise affected products.
Attackers can exploit the flaw through APIs in the JSSE component, for example through a web service that supplies data to those APIs. It also affects Java deployments that load and run untrusted code, such as code from the internet, and rely on the Java sandbox for security. Oracle gives clients running sandboxed Java Web Start applications or sandboxed Java applets as typical examples.
Why It Matters
Oracle scores the flaw CVSS 3.1 9.1 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N:
- Network-reachable with low attack complexity
- No privileges and no user interaction required
- High confidentiality and integrity impact; no availability impact
A successful attack can give an attacker unauthorized access to critical data, or complete access to all data the affected Java runtime can reach. It can also let the attacker create, delete, or modify that data.
Exploitation status: CVE-2026-91403 is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, so CISA has not confirmed active exploitation. NVD lists the record as "Received," published 2026-10-21.
What's Vulnerable
Oracle lists these supported versions as affected:
Oracle Java SE - 8u511 - 8u511-perf - 11.0.33 - 17.0.21 - 21.0.13 - 25.0.5 - 27.0.1
Oracle GraalVM for JDK - 17.0.21 - 21.0.13
Oracle GraalVM Enterprise Edition - 21.3.20
Exposure is highest for services that pass externally supplied data to JSSE APIs and for clients that run untrusted sandboxed Java code.
Patch Status
Fixed versions have not been publicly listed yet. Oracle has published a dedicated Security Alert for CVE-2026-91403, and administrators should check it for patch availability and remediation guidance. Because the CVE is not in the KEV catalog, there is no CISA-mandated remediation action or due date. The flaw is network-reachable and needs no authentication, so teams running the affected versions above should apply Oracle's guidance as a priority.