Description
Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
Published: 2026-10-20
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Modification
Action: Apply Update
AI Analysis

Impact

The vulnerability resides in the Networking component of Oracle Java SE. An unauthenticated attacker who can reach the target over the network and communicate via supported protocols can supply malicious data to exposed APIs, leading to unauthorized update, insert or delete of data accessible to the Java runtime. This flaw presents a related weakness (CWE-284) that permits data modification without proper authentication or authorization.

Affected Systems

Affected products include Oracle Java SE 8u503, 8u503‑perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, and 25.0.4.1, as well as Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1, and Oracle GraalVM Enterprise Edition 21.3.19.1.1.

Risk and Exploitability

Because the vulnerability requires only network access and no user authentication, it can be exploited from any reachable host. The CVSS 3.1 base score of 5.3 indicates moderate severity with low impact on integrity and no impact on confidentiality or availability. The EPSS score of < 1% indicates a very low exploitation likelihood, and the vulnerability is not listed in CISA KEV. An attacker can send crafted network traffic to the Java networking APIs to trigger the flaw and modify data at runtime. Systems exposed to the public internet or sharing internal networks should treat the risk as significant.

Generated by OpenCVE AI on October 23, 2026 at 04:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Oracle Java SE to the latest patched versions or install the October 2026 security update released by Oracle.
  • Apply the corresponding Oracle GraalVM patch for JDK 17.0.20.1, 21.0.12.1, or GraalVM Enterprise Edition 21.3.19.1.1 based on your deployment.
  • Restrict network reachability to the Java SE networking APIs by configuring firewall rules, disabling unused protocols, and monitoring API traffic for anomalous requests.

Generated by OpenCVE AI on October 23, 2026 at 04:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4861-1 openjdk-17 security update
History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle oracle Java Se
Vendors & Products Oracle oracle Java Se

Thu, 22 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Network-Based Data Modification in Oracle Java SE openjdk: Enhance HTTP server parsing (Oracle CPU 2026-10)
Weaknesses CWE-444
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 21 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Network-Based Data Modification in Oracle Java SE
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
First Time appeared Oracle
Oracle java Se
CPEs cpe:2.3:a:oracle:java_se:11.0.32.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:17.0.20.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:21.0.12.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:25.0.4.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u503:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u503:*:*:*:enterprise_performance:*:*:*
Vendors & Products Oracle
Oracle java Se
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Oracle Java Se Oracle Java Se
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T18:50:26.101Z

Reserved: 2026-09-14T22:10:16.635Z

Link: CVE-2026-91451

cve-icon Vulnrichment

Updated: 2026-10-22T18:48:00.139Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:48.850

Modified: 2026-10-22T19:18:05.240

Link: CVE-2026-91451

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-20T21:26:02Z

Links: CVE-2026-91451 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T04:45:14Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-444

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')