CVE-2026-91484

Awaiting Analysis Awaiting Analysis - Queue

Java Plugin Data Access Vulnerability in Oracle Java SE

Publication date: 2026-10-20

Last updated on: 2026-10-24

Assigner: Oracle

Description

Vulnerability in Oracle Java SE (component: Java plugin). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE. While the vulnerability is in Oracle Java SE, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-24

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-91484

EUVD

EUVD-2026-106729

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle Corporation	Oracle Java SE	8u503
Oracle Corporation	Oracle Java SE	8u503-perf

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Java SE, specifically in the Java plugin component. It affects versions 8u503 and 8u503-perf. The issue allows a low-privileged attacker with local access to compromise the Java SE environment. Attacks may also impact other products. Successful exploitation can lead to unauthorized data creation, deletion, modification, or access to all data accessible by Oracle Java SE.

Detection Guidance

This vulnerability affects Oracle Java SE versions 8u503 and 8u503-perf, specifically in Java plugin deployments running untrusted code. Detection should focus on identifying outdated Java versions and sandboxed Java Web Start or applet environments. Check installed Java versions using commands like 'java -version' or 'where java' on Windows. Inspect system for Java plugin usage in browsers or applications.

Impact Analysis

If you use Java deployments that load untrusted code like Java Web Start applications or applets, this vulnerability could allow attackers to access, modify, or delete critical data. It does not affect server deployments running only trusted code.

Compliance Impact

This vulnerability allows unauthorized access to or modification of critical data, which could lead to violations of data protection regulations like GDPR or HIPAA. Unauthorized data access or modification may result in non-compliance with these standards, potentially leading to legal penalties or data breaches.

Mitigation Strategies

Disable Java plugin in browsers and uninstall affected Oracle Java SE versions 8u503 and 8u503-perf. Ensure Java deployments only run trusted code and avoid loading untrusted Java Web Start applications or applets from the internet.

Hi! I’m here to help you understand CVE-2026-91484. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...