Vulnerability in Oracle Java SE, JavaFX, and GraalVM Enterprise Edition

CVE-2026-91402

What is CVE-2026-91402?

This vulnerability affects Oracle Java SE, JavaFX, and GraalVM Enterprise Edition products, enabling an unauthenticated attacker with network access to exploit weaknesses through various protocols. The flaw requires human interaction from a victim and can lead to unauthorized read access to certain data elements, particularly those processed in Java environments running untrusted applications. It is essential to note that this issue primarily impacts Java deployments in client settings, such as when executing sandboxed applications or applets that utilize the Java security model. Environments that strictly run trusted code are not vulnerable to this issue. Oracle has provided information for affected users on necessary mitigations to safeguard their systems.

References