Low Privileged Code Execution Vulnerability in Oracle Java SE and GraalVM
CVE-2026-91335

2.6LOW

Key Information:

Vendor

Oracle
Status
Oracle Java Se
Oracle Graalvm For Jdk
Oracle Graalvm Enterprise Edition
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91335?

A vulnerability in Oracle Java SE and GraalVM allows low-privileged attackers with network access to potentially compromise these platforms. It particularly impacts Java deployments that utilize sandboxed Java Web Start applications or applets, enabling unauthorized read access to sensitive data. Successful exploitation requires interaction from an end user, typically to execute untrusted code received via the internet. This issue emphasizes the importance of monitoring and securing environments that run untrusted Java applications.

Affected Version(s)

Oracle GraalVM Enterprise Edition 21.3.19.1.1

Oracle GraalVM for JDK 17.0.20.1

Oracle GraalVM for JDK 21.0.12.1

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
2.6
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.