Vulnerability in Oracle Java SE Plugin Exposes Data to Attackers
CVE-2026-91484

7.5HIGH

Key Information:

Vendor

Oracle
Status
Oracle Java Se
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91484?

A vulnerability exists in the Oracle Java SE plugin that allows low-privileged attackers with access to the execution environment to compromise the integrity of the system. This vulnerability primarily affects Oracle Java SE versions 8u503 and 8u503-perf, particularly in environments running sandboxed Java Web Start applications or applets that execute untrusted code from the internet. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data accessible to Oracle Java SE, with potential implications extending to a wide range of interconnected products.

Affected Version(s)

Oracle Java SE 8u503

Oracle Java SE 8u503-perf

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.