CVE-2026-91394
Awaiting Analysis Awaiting Analysis - Queue

Denial of Service in Oracle Java SE

Publication date: 2026-10-20

Last updated on: 2026-10-23

Assigner: Oracle

Description
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-23
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-08
NVD
CVE-2026-91394
EUVD
EUVD-2026-106648

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in Oracle Java SE and Oracle GraalVM for JDK affecting versions 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27 and GraalVM 17.0.20.1, 21.0.12.1. It allows an unauthenticated attacker with network access to potentially access sensitive data or gain full access to all accessible data in the affected software.

Detection Guidance

Detection requires checking for vulnerable versions of Oracle Java SE or GraalVM for JDK. Use commands like 'java -version' or 'gu -version' to verify installed versions. Compare against affected versions: 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27, or GraalVM 17.0.20.1 and 21.0.12.1.

Impact Analysis

An attacker could exploit this to access critical or sensitive data stored or processed by the affected Java applications. This includes data handled by web services using vulnerable APIs or Java applications running in sandboxed environments that load untrusted code.

Compliance Impact

This vulnerability could lead to unauthorized data access, potentially violating GDPR (data protection) and HIPAA (health information privacy) by exposing sensitive personal or health data. Organizations using affected versions must address this to maintain compliance.

Mitigation Strategies

Update affected Oracle Java SE and GraalVM for JDK versions to the latest patches provided by Oracle. Disable unnecessary network-facing APIs if possible. Restrict access to vulnerable systems via network controls.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91394. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...