Sound Vulnerability in Oracle Java SE and GraalVM Products
CVE-2026-91400

3.1LOW

Key Information:

Vendor

Oracle
Status
Oracle Java Se
Oracle Graalvm For Jdk
Oracle Graalvm Enterprise Edition
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91400?

A sound vulnerability in Oracle Java SE and GraalVM allows unauthenticated remote attackers to exploit affected systems, particularly those running sandboxed Java applications. Although it is difficult to exploit, successful attacks may result in a partial denial of service. This often requires user interaction, highlighting the need for cautious handling of untrusted code from internet sources. Notably, this issue primarily impacts Java deployments that depend on the Java sandbox for security, which are vulnerable to loading unverified code.

Affected Version(s)

Oracle GraalVM Enterprise Edition 21.3.19.1.1

Oracle GraalVM for JDK 17.0.20.1

Oracle GraalVM for JDK 21.0.12.1

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.