Networking Vulnerability in Oracle Java SE by Oracle
CVE-2026-91409

3.7LOW

Key Information:

Vendor

Oracle
Status
Oracle Java Se
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91409?

A vulnerability in Oracle Java SE affects the networking component of version 27. This vulnerability allows unauthenticated attackers with network access to potentially compromise Java SE through various protocols. Exploitation may lead to unauthorized partial denial of service, particularly in scenarios where untrusted code is executed via sandboxed Java Web Start applications or applets. Attackers can leverage APIs related to this component, emphasizing the importance of protecting against network-based threats in Java deployments.

Affected Version(s)

Oracle Java SE 27

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.