CVE-2026-91477

Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated Data Read in Oracle JavaFX

Publication date: 2026-10-20

Last updated on: 2026-10-24

Assigner: Oracle

Description

Vulnerability in the Oracle JavaFX product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle JavaFX: 25.0.4 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle JavaFX. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle JavaFX accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-24

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-91477

EUVD

EUVD-2026-106722

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle Corporation	Oracle JavaFX	25.0.4
Oracle Corporation	Oracle JavaFX	27

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-922	The product stores sensitive information without properly limiting read or write access by unauthorized actors.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle JavaFX versions 25.0.4 and 27. It allows an unauthenticated attacker to potentially read some data from Oracle JavaFX if a user interacts with untrusted code, such as web-based Java applications. The attack requires network access and human interaction beyond the attacker.

Detection Guidance

Detection involves checking for vulnerable Oracle JavaFX versions (25.0.4 or 27) on systems. Use commands like 'java -version' or inspect installed JavaFX packages via package managers (e.g., 'dpkg -l | grep javafx' on Debian/Ubuntu).

Impact Analysis

If you use JavaFX in a client environment like sandboxed Java Web Start or applets that load untrusted code from the internet, an attacker might access some of your data. Servers running trusted code are not affected.

Compliance Impact

This vulnerability allows unauthorized read access to a subset of data in Oracle JavaFX, which could potentially expose sensitive information. For GDPR, this may lead to unauthorized data access, violating principles of data protection and user rights. For HIPAA, it could compromise protected health information if exploited in healthcare applications.

Mitigation Strategies

Upgrade Oracle JavaFX to a patched version if available. Disable Java Web Start applications and sandboxed Java applets if not required. Restrict network access to Java deployments and monitor for suspicious activity.

Hi! I’m here to help you understand CVE-2026-91477. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...