Description
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 2.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 2.6 Low
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data read (confidentiality compromise)
Action: Assess Impact
AI Analysis

Impact

The vulnerability exists in the AWT component of Oracle Java SE and Oracle GraalVM products and allows a low‑privileged attacker with network access to read a limited set of data stored by the application. The attack requires human interaction from a user other than the attacker and occurs through multiple protocols. The CVSS 3.1 base score of 2.6 reflects a low confidentiality impact in the presence of network reachability, high attack complexity, low privileges, and a required user interface interaction.

Affected Systems

Affected products include Oracle Java SE (v8u503, 8u503‑perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27), Oracle GraalVM for JDK (v17.0.20.1, 21.0.12.1), and Oracle GraalVM Enterprise Edition (v21.3.19.1.1). Only installations that run sandboxed Web Start applications or sandboxed applets containing untrusted code are impacted; typical server deployments that load only trusted code are not affected.

Risk and Exploitability

The CVSS score indicates low risk, and the EPSS score of < 1% indicates a very low exploitation probability, with no listing in the CISA KEV catalog. Exploitation requires network exposure of the vulnerable protocols and an end‑user action, which limits the likelihood of automated attacks. However, the confidentiality breach could affect sensitive data visible to the user and any processes that subsequently access that data. Organizations running client‑side Java applications that consume untrusted code should consider the vulnerability significant in the context of data protection policies, even though it is not a critical exploit.

Generated by OpenCVE AI on October 28, 2026 at 20:06 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest security patches for Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition.
  • Restrict network exposure of client Java applications by limiting or blocking the protocols that can invoke the AWT component, such as through firewall or proxy rules.
  • Ensure that sandboxed Java Web Start or applets do not load untrusted code; consider disabling the sandbox or migrating to a different technology if untrusted code is required.

Generated by OpenCVE AI on October 28, 2026 at 20:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4861-1 openjdk-17 security update
History

Wed, 28 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-250

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle graalvm Enterprise Edition
Oracle oracle Java Se
Vendors & Products Oracle graalvm Enterprise Edition
Oracle oracle Java Se

Thu, 22 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Read via AWT in Oracle Java and GraalVM openjdk: Enhance Image Handling (Oracle CPU 2026-10)
Weaknesses CWE-653
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Read via AWT in Oracle Java and GraalVM
Weaknesses CWE-200

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 2.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle graalvm
Oracle graalvm For Jdk
Oracle java Se
CPEs cpe:2.3:a:oracle:graalvm:21.3.19.1.1:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:17.0.20.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:21.0.12.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:11.0.32.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:17.0.20.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:21.0.12.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:25.0.4.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:27:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u503:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u503:*:*:*:enterprise_performance:*:*:*
Vendors & Products Oracle
Oracle graalvm
Oracle graalvm For Jdk
Oracle java Se
References
Metrics cvssV3_1

{'score': 2.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Graalvm Graalvm Enterprise Edition Graalvm For Jdk Java Se Oracle Java Se
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T17:54:38.881Z

Reserved: 2026-09-14T22:10:16.628Z

Link: CVE-2026-91335

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:35.757

Modified: 2026-10-28T18:17:22.503

Link: CVE-2026-91335

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-20T21:25:22Z

Links: CVE-2026-91335 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T20:15:14Z

Weaknesses
  • CWE-250

    Execution with Unnecessary Privileges

  • CWE-653

    Improper Isolation or Compartmentalization