Description
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Modification and Partial Denial of Service
Action: Patch Now
AI Analysis

Impact

This vulnerability arises in the 2D component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. It allows an unauthenticated attacker with network access over multiple protocols to trigger unauthorized creation, deletion, or modification of critical data. The flaw can also lead to a partial denial of service. The exploitation can occur by calling vulnerable APIs exposed by the component, for example through a web service that supplies data to those APIs. Java deployments such as sandboxed Web Start applications or applets that load untrusted code and rely on the Java sandbox are also susceptible, as the flaw bypasses the sandbox’s security checks.

Affected Systems

Affected products include Oracle Corporation’s Java SE version 8u503, 11.0.32.1 and 17.0.20.1; Oracle GraalVM for JDK versions 17.0.20.1 and 21.0.12.1; and Oracle GraalVM Enterprise Edition version 21.3.19.1.1. All affected versions contain the 2D component that is vulnerable.

Risk and Exploitability

The vulnerability has a CVSS v3.1 base score of 6.5, indicating moderate severity with high integrity impact and low availability impact. EPSS score of <1%, which indicates a very low probability of exploitation, and the flaw is not listed in CISA KEV. The likely attack vector is remote network access; no authentication or local privileges are required. Attackers could exploit the flaw via exposed APIs or by tricking sandboxed applications into executing untrusted code, thereby compromising data integrity or interrupting service availability.

Generated by OpenCVE AI on October 22, 2026 at 16:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Oracle’s official patches for Oracle Java SE 8u503, 11.0.32.1, 17.0.20.1 and for Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1, as well as for Oracle GraalVM Enterprise Edition 21.3.19.1.1
  • If a patch is not yet released, restrict network exposure of vulnerable components by implementing firewall rules or network segmentation to block unnecessary inbound connections to the services that expose the vulnerable 2D APIs
  • Continuously monitor system logs for unusual API calls or privilege escalation attempts and audit sandboxed Java application behavior for signs of unauthorized code execution

Generated by OpenCVE AI on October 22, 2026 at 16:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4861-1 openjdk-17 security update
History

Thu, 22 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Modification and Partial Denial of Service via Oracle Java SE and GraalVM 2D Component openjdk: Enhance Image Processing (Oracle CPU 2026-10)
Weaknesses CWE-1286
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 21 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Oracle graalvm Enterprise Edition
Oracle oracle Java Se
Vendors & Products Oracle graalvm Enterprise Edition
Oracle oracle Java Se

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Modification and Partial Denial of Service via Oracle Java SE and GraalVM 2D Component
Weaknesses CWE-284
CWE-400

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L).
First Time appeared Oracle
Oracle graalvm
Oracle graalvm For Jdk
Oracle java Se
CPEs cpe:2.3:a:oracle:graalvm:21.3.19.1.1:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:17.0.20.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:21.0.12.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:11.0.32.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:17.0.20.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u503:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u503:*:*:*:enterprise_performance:*:*:*
Vendors & Products Oracle
Oracle graalvm
Oracle graalvm For Jdk
Oracle java Se
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L'}

Subscriptions

Oracle Graalvm Graalvm Enterprise Edition Graalvm For Jdk Java Se Oracle Java Se
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T15:12:03.820Z

Reserved: 2026-09-14T22:10:16.631Z

Link: CVE-2026-91382

cve-icon Vulnrichment

Updated: 2026-10-21T15:11:59.843Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:41.360

Modified: 2026-10-21T18:45:11.277

Link: CVE-2026-91382

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-20T21:25:39Z

Links: CVE-2026-91382 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T17:00:10Z

Weaknesses
  • CWE-1286

    Improper Validation of Syntactic Correctness of Input

  • CWE-284

    Improper Access Control