Network Access Vulnerability in Oracle Java SE and GraalVM
CVE-2026-91487

4.8MEDIUM

Key Information:

Vendor

Oracle
Status
Oracle Java Se
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91487?

A vulnerability in Oracle Java SE and GraalVM allows unauthenticated attackers with network access to exploit specific APIs, potentially leading to unauthorized modifications and access to sensitive data. This exploitation does not rely on untrusted Java Web Start applications or applets, making it particularly insidious. Users should promptly evaluate their use of affected versions to mitigate risks associated with unauthorized data manipulation and exposure.

Affected Version(s)

Oracle Java SE 8u503-perf

Oracle Java SE 11.0.32.1

Oracle Java SE 17.0.20.1

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.