Vulnerability in Oracle JavaFX Product by Oracle
CVE-2026-91477

3.1LOW

Key Information:

Vendor

Oracle
Status
Oracle Javafx
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91477?

A security flaw in Oracle JavaFX allows unauthenticated attackers with network access to exploit vulnerable clients running sandboxed applications. While requiring user interaction, successful exploitation can lead to unauthorized access to sensitive data within Oracle JavaFX. This risk primarily affects deployments using untrusted code via Java Web Start or Java applets and does not impact servers that execute only trusted code. It emphasizes the need for caution in environments utilizing Java applications that load external code.

Affected Version(s)

Oracle JavaFX 25.0.4

Oracle JavaFX 27

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.