Denial of Service and Unauthorized Access in Oracle Java SE and GraalVM Products
CVE-2026-91415

7HIGH

Key Information:

Vendor

Oracle
Status
Oracle Java Se
Oracle Graalvm For Jdk
Oracle Graalvm Enterprise Edition
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91415?

A vulnerability in Oracle Java SE and GraalVM products enables unauthenticated attackers with network access to exploit the system through various protocols. This can lead to denial of service through hangs or crashes of the affected applications. Additionally, the flaw allows unauthorized data manipulation, which includes unauthorized read, update, insert, or delete actions on accessible data. It significantly impacts Java deployments that execute untrusted code. Users should take prompt action to mitigate potential attacks.

Affected Version(s)

Oracle GraalVM Enterprise Edition 21.3.19.1.1

Oracle GraalVM for JDK 17.0.20.1

Oracle GraalVM for JDK 21.0.12.1

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
7
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.