Vulnerability in Oracle Java SE and GraalVM Enterprise Edition
CVE-2026-91417

5.3MEDIUM

Key Information:

Vendor

Oracle
Status
Oracle Java Se
Oracle Graalvm Enterprise Edition
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91417?

An exploitable vulnerability exists in Oracle Java SE and Oracle GraalVM Enterprise Edition, specifically within the CORBA component. This vulnerability allows an unauthenticated attacker with network access to instigate a partial denial of service. The issue can be leveraged through various protocols by sending data to APIs in the affected component without requiring untrusted applications like Java Web Start or applets. This makes it crucial for users to update to the latest versions to mitigate potential exploitation.

Affected Version(s)

Oracle GraalVM Enterprise Edition 21.3.19.1.1

Oracle Java SE 8u503

Oracle Java SE 8u503-perf

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.