Oracle Java SE and GraalVM Serviceability Vulnerability
CVE-2026-91374

4.8MEDIUM

Key Information:

Vendor

Oracle
Status
Oracle Java Se
Oracle Graalvm For Jdk
Oracle Graalvm Enterprise Edition
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91374?

A vulnerability exists in the Oracle Java SE and GraalVM products that could be exploited by an unauthenticated attacker with network access through various protocols. This vulnerability allows unauthorized updates, inserts, or deletions of accessible data within affected versions of Oracle Java SE and GraalVM. An attacker could also gain unauthorized read access to specific data. The impact can extend to Java deployments involving sandboxed applications, relying on Java's security mechanisms. Exploitation is primarily through APIs served by a web service, making it crucial for users to stay updated with the latest security patches from Oracle.

Affected Version(s)

Oracle GraalVM Enterprise Edition 21.3.19.1.1

Oracle GraalVM for JDK 17.0.20.1

Oracle GraalVM for JDK 21.0.12.1

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.