Vulnerability in Oracle Java SE and GraalVM Products
CVE-2026-91380

4MEDIUM

Key Information:

Vendor

Oracle
Status
Oracle Java Se
Oracle Graalvm For Jdk
Oracle Graalvm Enterprise Edition
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91380?

This vulnerability affects Oracle Java SE and GraalVM products, enabling unauthenticated attackers with access to the infrastructure where these applications execute. It allows the potential for unauthorized updates, deletions, and reads of various accessible data. The issue is exacerbated in environments reliant on Java sandboxing to manage untrusted code execution. Exploitation could occur through API calls in services that interact with these Java components, particularly through Java Web Start applications and applets, posing a significant risk to data integrity and confidentiality.

Affected Version(s)

Oracle GraalVM Enterprise Edition 21.3.19.1.1

Oracle GraalVM for JDK 17.0.20.1

Oracle GraalVM for JDK 21.0.12.1

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.