CVE-2026-91451
Awaiting Analysis Awaiting Analysis - Queue

Java SE Networking Component Integrity Flaw

Publication date: 2026-10-20

Last updated on: 2026-10-22

Assigner: Oracle

Description
Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-22
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-08
NVD
CVE-2026-91451
EUVD
EUVD-2026-106701

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in Oracle Java SE's Networking component affecting multiple versions. It allows unauthenticated attackers with network access to potentially modify data in Oracle Java SE through APIs without needing Java Web Start or applets. The impact is limited to data integrity, with a CVSS score of 5.3 indicating low severity.

Detection Guidance

This vulnerability affects Oracle Java SE and GraalVM versions listed in the CVE. Detection involves checking installed Java versions against the affected releases. Use commands like 'java -version' or 'where java' to identify installed versions. Compare these against the affected versions (8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, etc.).

Impact Analysis

If you use affected versions of Oracle Java SE, an attacker could modify some data in your Java SE environment. This could lead to incorrect or corrupted data being processed or stored. The attack requires network access but no authentication.

Compliance Impact

This vulnerability allows unauthorized modification of data, which could lead to integrity issues. For GDPR, this may impact data accuracy requirements under Article 5. For HIPAA, it could affect integrity safeguards under the Security Rule. However, specific compliance impacts depend on system configurations and data handling practices.

Mitigation Strategies

Apply the latest security patches for Oracle Java SE versions 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1, and Oracle GraalVM Enterprise Edition 21.3.19.1.1. Monitor Oracle's security advisories for updates and disable unnecessary network protocols if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91451. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...