Description
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SOCKS5 to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.8 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N).
Published: 2026-10-20
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Integrity Compromise
Action: Patch Immediately
AI Analysis

Impact

This vulnerability allows an unauthenticated attacker to exploit a flaw in the Networking component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition, using a SOCKS5 connection to create, delete, or modify critical data. The unauthorized changes affect all data accessible through these products, including sandboxed Java Web Start applications or applets that run untrusted code. The flaw can lead to significant integrity damage but does not grant full system compromise.

Affected Systems

Affected versions are Oracle Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition 21.3.19.1.1. Products that rely on these Java or GraalVM runtimes may also see the integrity impact due to a scope change noted in the advisory.

Risk and Exploitability

The CVSS base score of 6.8 indicates moderate severity with a focus on integrity impact. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower current exploitation probability. The likely attack vector is a network-based exploitation via SOCKS5, requiring access to the exposed Java networking APIs. The description confirms that the flaw can be exploited by calling vulnerable APIs, for example through a web service providing data to these APIs. While exploitation requires network access and knowledge of the API surface, the low EPSS score and KEV absence reduce the immediacy of widespread attacks.

Generated by OpenCVE AI on October 23, 2026 at 05:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Download and install the latest security updates for Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition from Oracle's security advisory.
  • Restrict or disable SOCKS5 proxies on target systems and limit use of networking APIs exposed by Java services.
  • Configure firewall or network rules to block unauthorized remote connections to the Java networking services and monitor for suspicious API activity.

Generated by OpenCVE AI on October 23, 2026 at 05:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4861-1 openjdk-17 security update
History

Fri, 23 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Oracle graalvm Enterprise Edition
Oracle oracle Java Se
Vendors & Products Oracle graalvm Enterprise Edition
Oracle oracle Java Se

Thu, 22 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-250
CWE-269

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network-Based Integrity Compromise via SOCKS5 in Oracle Java SE and GraalVM openjdk: Enhance SOCKS5 support (Oracle CPU 2026-10)
Weaknesses CWE-358
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 21 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network-Based Integrity Compromise via SOCKS5 in Oracle Java SE and GraalVM
Weaknesses CWE-250
CWE-269

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SOCKS5 to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.8 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N).
First Time appeared Oracle
Oracle graalvm
Oracle graalvm For Jdk
Oracle java Se
CPEs cpe:2.3:a:oracle:graalvm:21.3.19.1.1:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:17.0.20.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:21.0.12.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:11.0.32.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:17.0.20.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:21.0.12.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:25.0.4.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:27:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u503:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u503:*:*:*:enterprise_performance:*:*:*
Vendors & Products Oracle
Oracle graalvm
Oracle graalvm For Jdk
Oracle java Se
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N'}

Subscriptions

Oracle Graalvm Graalvm Enterprise Edition Graalvm For Jdk Java Se Oracle Java Se
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-23T02:24:25.266Z

Reserved: 2026-09-14T22:10:16.632Z

Link: CVE-2026-91398

cve-icon Vulnrichment

Updated: 2026-10-23T02:24:21.023Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:43.207

Modified: 2026-10-23T03:16:31.787

Link: CVE-2026-91398

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-20T21:25:45Z

Links: CVE-2026-91398 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T06:00:13Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-358

    Improperly Implemented Security Check for Standard