Description
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-10-21
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data manipulation and unauthorized access to critical data
Action: Immediate Patch
AI Analysis

Impact

A vulnerability in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows an unauthenticated attacker with network access to perform unauthorized creation, deletion, or modification of critical data. Classified as CWE-295 (improper verification of cryptographic signatures) and CWE-327 (weakness in the use of cryptographic keys), this flaw involves distrust of intermediate CA certificates, undermining certificate validation and enabling unauthorized access to all data processed by these products. The vulnerability has high confidentiality and integrity impact but does not affect availability.

Affected Systems

The affected products are Oracle GraalVM Enterprise Edition 21.3.20; Oracle GraalVM for JDK 17.0.21 and 21.0.13; and Oracle Java SE versions 8u511 (including 8u511-perf), 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1. These versions are listed as supported but vulnerable in the Oracle security advisory and are present in the CPE entries.

Risk and Exploitability

The CVSS score of 9.1 places the flaw in the critical severity category. The EPSS score of <1% indicates a very low probability of exploitation, but the lack of authentication requirement and network reachability mean once discovered it could be exploited in any environment exposing the affected Java or GraalVM services. The vulnerability is not listed in CISA's KEV catalog. Based on the description, the attack vector is remote network access, potentially via web services or any API that uses JSSE. The flaw can be triggered in Java deployments that load and run untrusted code in sandboxed Web Start applications or applets that rely on the Java sandbox.

Generated by OpenCVE AI on October 25, 2026 at 09:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patches for Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition that address CVE-2026-91403
  • Reduce the attack surface by restricting external network access to Java or GraalVM services using firewalls or VPNs until the patch is deployed
  • Disable or restrict Java sandboxed Web Start applications and applets that load code from untrusted sources, and enforce stricter security policies on Java APIs that communicate over JSSE
  • As a temporary measure, avoid using APIs that rely on the vulnerable JSSE component until a patch is available

Generated by OpenCVE AI on October 25, 2026 at 09:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 25 Oct 2026 07:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Sun, 25 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-327

Fri, 23 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-264
CWE-285

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Title Oracle Java/GraalVM JSSE Vulnerability Allows Unauthenticated Remote Data Manipulation OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns
Weaknesses CWE-295
References
Metrics threat_severity

None

 threat_severity

Critical

Thu, 22 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Oracle graalvm Enterprise Edition
Oracle oracle Java Se
Vendors & Products Oracle graalvm Enterprise Edition
Oracle oracle Java Se

Thu, 22 Oct 2026 05:45:00 +0000

Type Values Removed Values Added
Title Oracle Java/GraalVM JSSE Vulnerability Allows Unauthenticated Remote Data Manipulation
Weaknesses CWE-264
CWE-285

Wed, 21 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle graalvm
Oracle graalvm For Jdk
Oracle java Se
CPEs cpe:2.3:a:oracle:graalvm:21.3.20:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:17.0.21:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:21.0.13:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:11.0.33:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:17.0.21:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:21.0.13:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:25.0.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:27.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u511:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u511:*:*:*:enterprise_performance:*:*:*
Vendors & Products Oracle
Oracle graalvm
Oracle graalvm For Jdk
Oracle java Se
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Graalvm Graalvm Enterprise Edition Graalvm For Jdk Java Se Oracle Java Se
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-24T20:01:56.993Z

Reserved: 2026-09-14T22:10:16.632Z

Link: CVE-2026-91403

cve-icon Vulnrichment

Updated: 2026-10-23T10:29:05.172Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T22:16:50.243

Modified: 2026-10-24T20:16:30.970

Link: CVE-2026-91403

cve-icon Redhat

Severity : Critical

Publid Date: 2026-10-21T21:23:28Z

Links: CVE-2026-91403 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-25T09:30:10Z

Weaknesses
  • CWE-295

    Improper Certificate Validation

  • CWE-327

    Use of a Broken or Risky Cryptographic Algorithm