Oracle has released an out-of-band security alert addressing a critical vulnerability, CVE-2026-91403, affecting Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition.
The vulnerability has been assigned a CVSS v3.1 severity score of 9.1 and can be exploited remotely without authentication. Successful exploitation could allow attackers to gain unauthorized access to sensitive information or modify critical data accessible through affected Java environments.
Attribute | Details |
CVE ID | CVE-2026-91403 |
Severity | Critical |
CVSS v3.1 score | 9.1 |
Affected component | Java Secure Socket Extension (JSSE) |
Attack vector | Network |
Authentication required | No |
User interaction required | No |
Impact | High confidentiality and integrity impact |
Advisory release date | October 21, 2026 |
Product | Affected versions |
Oracle Java SE | 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1 |
Oracle GraalVM for JDK | 17.0.21, 21.0.13 |
Oracle GraalVM Enterprise Edition | 21.3.20 |
Note: Oracle indicates that earlier versions may also be vulnerable. Administrators are advised to review their Java installations and ensure they are running supported, security-patched versions.
The vulnerability affects the Java Secure Socket Extension (JSSE) component, which provides secure communication capabilities for Java applications.
The corresponding OpenJDK security advisory identifies the issue as involving eight compromised intermediate certificate authority certificates.
Successful exploitation could potentially result in:
Unauthorized access to sensitive or critical application data.
Unauthorized modification, creation, or deletion of data.
Compromise of affected Java applications through network-accessible interfaces.
CVE ID | Patch ID | Patch Description |
CVE-2026-91403 | 365816 | Java(TM) SE Development Kit 25 (MSI) (x64) (25.0.5.0) |
CVE-2026-91403 | 365873 | Java Runtime Environment 1.8 (8.0.5110.32) (Manual Upload Required) |
CVE-2026-91403 | 365875 | Java SE Development Kit 1.8 (x64) (8.0.5110.32) (Manual Upload Required) |
CVE-2026-91403 | 365877 | Java Runtime Environment 1.8 (x64) (8.0.5110.32) (Manual Upload Required) |
CVE-2026-91403 | 365878 | Java SE Development Kit 1.8 (8.0.5110.32) (Manual Upload Required) |
CVE ID | Patch ID | Patch Description |
CVE-2026-91403 | 365816 | Java(TM) SE Development Kit 25 (MSI) (x64) (25.0.5.0) |
CVE-2026-91403 | 365873 | Java Runtime Environment 1.8 (8.0.5110.32) (Manual Upload Required) |
CVE-2026-91403 | 365875 | Java SE Development Kit 1.8 (x64) (8.0.5110.32) (Manual Upload Required) |
CVE-2026-91403 | 365877 | Java Runtime Environment 1.8 (x64) (8.0.5110.32) (Manual Upload Required) |
CVE-2026-91403 | 365878 | Java SE Development Kit 1.8 (8.0.5110.32) (Manual Upload Required) |
To install this update on your Windows machines, initiate a database sync; Once the sync is complete, search for the above Patch IDs and deploy them to your target systems.
We recommend deploying these patches as soon as possible, as they address the critical vulnerability across Java Components.
To know more about this refer to: https://www.oracle.com/security-alerts/alert-cve-2026-91403.html
Regards,
The ManageEngine Team.