Description
Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Published: 2026-10-20
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data access and modification via unauthenticated network exploitation of the Oracle Java SE compiler
Action: Apply Patch
AI Analysis

Impact

Oracle Java SE contains a vulnerability in the Compiler component that allows an attacker to supply crafted data to protected APIs. By doing so, the attacker can perform unauthorized insert, update, or delete operations on data exposed by Java SE, as well as read a subset of that data. The flaw has a CVSS score of 4.8 and affects confidentiality and integrity but does not directly compromise system availability.

Affected Systems

Affected versions include Oracle Java SE 8u503‑perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, as well as Oracle GraalVM for JDK 17.0.20.1, 21.0.12.1, and Oracle GraalVM Enterprise Edition 21.3.19.1.1. These components are used in client‑side and server‑side Java applications that can be exposed over the network.

Risk and Exploitability

The vulnerability can be triggered by an unauthenticated attacker with network access via multiple protocols, but not by untrusted Java Web Start applications or untrusted applets. The attack requires supplying data to the Component’s APIs, often through a web service interface. While the CVSS score indicates a moderate impact, the absence of a KEV listing and the EPSS score of <1%, indicating a very low but nonzero exploitation probability, suggest that exploitation may not be widespread yet, yet the potential for unauthorized data manipulation remains significant, especially in environments where the Java SE compiler APIs are exposed to external traffic.

Generated by OpenCVE AI on October 24, 2026 at 05:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest Oracle Java SE update that contains the fix for CVE‑2026‑91487
  • If upgrading immediately is not feasible, block or isolate external traffic to the Java SE compiler APIs to prevent unauthenticated access
  • Implement stricter input validation for all data passed to the compiler APIs, accepting only trusted and expected input
  • Enable detailed logging and monitor for anomalous API usage patterns that could indicate exploitation attempts

Generated by OpenCVE AI on October 24, 2026 at 05:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4861-1 openjdk-17 security update
History

Sat, 24 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Oracle oracle Java Se
Vendors & Products Oracle oracle Java Se

Thu, 22 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network‑Based Exploit of Oracle Java SE Compiler Leading to Unauthorized Data Access openjdk: Enhance C2 comparisons (Oracle CPU 2026-10)
Weaknesses CWE-1025
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 21 Oct 2026 11:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network‑Based Exploit of Oracle Java SE Compiler Leading to Unauthorized Data Access
Weaknesses CWE-20

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
First Time appeared Oracle
Oracle java Se
CPEs cpe:2.3:a:oracle:java_se:11.0.32.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:17.0.20.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:21.0.12.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:25.0.4.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:27:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u503:*:*:*:enterprise_performance:*:*:*
Vendors & Products Oracle
Oracle java Se
References
Metrics cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Oracle Java Se Oracle Java Se
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-24T03:29:02.474Z

Reserved: 2026-09-14T22:10:16.638Z

Link: CVE-2026-91487

cve-icon Vulnrichment

Updated: 2026-10-24T03:28:56.175Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:53.160

Modified: 2026-10-24T04:18:25.067

Link: CVE-2026-91487

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-20T21:26:13Z

Links: CVE-2026-91487 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-24T06:00:14Z

Weaknesses