Unauthenticated Access Vulnerability in Oracle Java SE and GraalVM Products
CVE-2026-91379

4.7MEDIUM

Key Information:

Vendor

Oracle
Status
Oracle Java Se
Oracle Graalvm For Jdk
Oracle Graalvm Enterprise Edition
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91379?

This vulnerability in Oracle Java SE and GraalVM products allows an unauthenticated attacker with access to the execution environment to interact with the affected systems. Through deceptive techniques requiring human interaction, attackers can gain unauthorized control over critical data. It affects Java deployments that execute untrusted code, such as those running sandboxed Java Web Start applications or applets. Importantly, it does not impact environments where only trusted code is executed.

Affected Version(s)

Oracle GraalVM Enterprise Edition 21.3.19.1.1

Oracle GraalVM for JDK 17.0.20.1

Oracle GraalVM for JDK 21.0.12.1

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.