Vulnerability-Lookup

WID-SEC-W-2026-4139

Vulnerability from csaf_certbund - Published: 2026-10-22 22:00 - Updated: 2026-10-28 23:00

Summary

Oracle Java SE and GraalVM, und OpenJDK: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Die Java Platform, Standard Edition (SE) ist eine Sammlung von Java-APIs (JDK) und der Java Laufzeit Umgebung (JRE). GraalVM ist eine universelle virtuelle Maschine zum Ausführen von Anwendungen, die in JavaScript, Python, Ruby, R, JVM-basierten Sprachen wie Java, Scala, Groovy, Kotlin, Clojure und LLVM-basierten Sprachen wie C und C++ geschrieben wurden. OpenJDK ist eine Java Umgebung, die unter der GPLv2 veröffentlicht wird.

Angriff: Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Oracle Java SE, Oracle GraalVM und OpenJDK ausnutzen, um Sicherheitsvorkehrungen zu umgehen und dadurch Daten offenzulegen oder zu verändern.

Betroffene Betriebssysteme: - Linux - MacOS X - UNIX - Windows

CVE-2026-91403

Affected products

Known affected 17 products

Product	Identifier	Version
Oracle Java SE <17.0.21 Oracle / Java SE		<17.0.21
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Oracle Java SE <21.0.13 Oracle / Java SE		<21.0.13
Oracle Java SE <25.0.5 Oracle / Java SE		<25.0.5
Broadcom Fabric OS Broadcom	`cpe:/o:broadcom:fabric_operating_system:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Oracle Java SE <8u511 Oracle / Java SE		<8u511
Oracle GraalVM Enterprise Edition <21.3.20 Oracle / GraalVM		Enterprise Edition <21.3.20
IBM Semeru Runtime IBM	`cpe:/a:ibm:semeru_runtime:-`	—
Oracle Java SE <8u511-perf Oracle / Java SE		<8u511-perf
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
HCL Domino HCL	`cpe:/a:hcltech:domino:-`	—
Open Source OpenJDK Open Source	`cpe:/a:oracle:openjdk:-`	—
Oracle Java SE <11.0.33 Oracle / Java SE		<11.0.33
Oracle Java SE <27.0.1 Oracle / Java SE		<27.0.1
Oracle GraalVM for JDK <17.0.21 Oracle / GraalVM		for JDK <17.0.21
Oracle GraalVM for JDK <21.0.13 Oracle / GraalVM		for JDK <21.0.13

References

13 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.oracle.com/security-alerts/alert-cve-…	external
https://openjdk.org/groups/vulnerability/advisori…	external
https://alas.aws.amazon.com/AL2/ALAS2-2026-4040.html	external
https://alas.aws.amazon.com/AL2/ALAS2-2026-4039.html	external
https://alas.aws.amazon.com/AL2/ALAS2CORRETTO8-20…	external
https://support.broadcom.com/web/ecx/support-cont…	external
https://www.ibm.com/support/pages/node/7293552	external
https://support.hcl-software.com/community?id=com…	external
https://lists.debian.org/debian-security-announce…	external
https://access.redhat.com/errata/RHSA-2026:88347	external
https://access.redhat.com/errata/RHSA-2026:88353	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Die Java Platform, Standard Edition (SE) ist eine Sammlung von Java-APIs (JDK) und der Java Laufzeit Umgebung (JRE).\r\nGraalVM ist eine universelle virtuelle Maschine zum Ausf\u00fchren von Anwendungen, die in JavaScript, Python, Ruby, R, JVM-basierten Sprachen wie Java, Scala, Groovy, Kotlin, Clojure und LLVM-basierten Sprachen wie C und C++ geschrieben wurden.\r\nOpenJDK ist eine Java Umgebung, die unter der GPLv2 ver\u00f6ffentlicht wird.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Oracle Java SE, Oracle GraalVM und OpenJDK ausnutzen, um Sicherheitsvorkehrungen zu umgehen und dadurch Daten offenzulegen oder zu ver\u00e4ndern.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- MacOS X\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-4139 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-4139.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-4139 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4139"
      },
      {
        "category": "external",
        "summary": "Oracle Security Alert Advisory vom 2026-10-22",
        "url": "https://www.oracle.com/security-alerts/alert-cve-2026-91403.html"
      },
      {
        "category": "external",
        "summary": "OpenJDK Vulnerability Advisory: 2026/10/21",
        "url": "https://openjdk.org/groups/vulnerability/advisories/2026-10-21"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2-2026-4040 vom 2026-10-25",
        "url": "https://alas.aws.amazon.com/AL2/ALAS2-2026-4040.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2-2026-4039 vom 2026-10-25",
        "url": "https://alas.aws.amazon.com/AL2/ALAS2-2026-4039.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2CORRETTO8-2026-026 vom 2026-10-25",
        "url": "https://alas.aws.amazon.com/AL2/ALAS2CORRETTO8-2026-026.html"
      },
      {
        "category": "external",
        "summary": "Brocade Security Advisory vom 2026-10-27",
        "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/39437"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7293552 vom 2026-10-26",
        "url": "https://www.ibm.com/support/pages/node/7293552"
      },
      {
        "category": "external",
        "summary": "HCL Security Bulletin vom 2026-10-28",
        "url": "https://support.hcl-software.com/community?id=community_blog\u0026sys_id=59abf5842b1c5b500c64f1a1d891bf2c"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-6588 vom 2026-10-27",
        "url": "https://lists.debian.org/debian-security-announce/2026/msg00507.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:88347 vom 2026-10-28",
        "url": "https://access.redhat.com/errata/RHSA-2026:88347"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:88353 vom 2026-10-28",
        "url": "https://access.redhat.com/errata/RHSA-2026:88353"
      }
    ],
    "source_lang": "en-US",
    "title": "Oracle Java SE and GraalVM, und OpenJDK: Schwachstelle erm\u00f6glicht Umgehen von Sicherheitsvorkehrungen",
    "tracking": {
      "current_release_date": "2026-10-28T23:00:00.000+00:00",
      "generator": {
        "date": "2026-10-29T09:04:42.772+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.7.0"
        }
      },
      "id": "WID-SEC-W-2026-4139",
      "initial_release_date": "2026-10-22T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-10-22T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-10-25T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2026-10-26T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2026-10-27T23:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von HCL und Debian aufgenommen"
        },
        {
          "date": "2026-10-28T23:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Red Hat aufgenommen"
        }
      ],
      "status": "final",
      "version": "5"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Broadcom Fabric OS",
            "product": {
              "name": "Broadcom Fabric OS",
              "product_id": "978054",
              "product_identification_helper": {
                "cpe": "cpe:/o:broadcom:fabric_operating_system:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Broadcom"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "HCL Domino",
            "product": {
              "name": "HCL Domino",
              "product_id": "777623",
              "product_identification_helper": {
                "cpe": "cpe:/a:hcltech:domino:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "HCL"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "IBM Semeru Runtime",
            "product": {
              "name": "IBM Semeru Runtime",
              "product_id": "T048255",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:semeru_runtime:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Open Source OpenJDK",
            "product": {
              "name": "Open Source OpenJDK",
              "product_id": "T061787",
              "product_identification_helper": {
                "cpe": "cpe:/a:oracle:openjdk:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "for JDK \u003c17.0.21",
                "product": {
                  "name": "Oracle GraalVM for JDK \u003c17.0.21",
                  "product_id": "T061782"
                }
              },
              {
                "category": "product_version",
                "name": "for JDK 17.0.21",
                "product": {
                  "name": "Oracle GraalVM for JDK 17.0.21",
                  "product_id": "T061782-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:graalvm:for_jdk__17.0.21"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "for JDK \u003c21.0.13",
                "product": {
                  "name": "Oracle GraalVM for JDK \u003c21.0.13",
                  "product_id": "T061783"
                }
              },
              {
                "category": "product_version",
                "name": "for JDK 21.0.13",
                "product": {
                  "name": "Oracle GraalVM for JDK 21.0.13",
                  "product_id": "T061783-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:graalvm:for_jdk__21.0.13"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Enterprise Edition \u003c21.3.20",
                "product": {
                  "name": "Oracle GraalVM Enterprise Edition \u003c21.3.20",
                  "product_id": "T061784"
                }
              },
              {
                "category": "product_version",
                "name": "Enterprise Edition 21.3.20",
                "product": {
                  "name": "Oracle GraalVM Enterprise Edition 21.3.20",
                  "product_id": "T061784-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:graalvm:enterprise_edition__21.3.20"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "GraalVM"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c8u511",
                "product": {
                  "name": "Oracle Java SE \u003c8u511",
                  "product_id": "T061773"
                }
              },
              {
                "category": "product_version",
                "name": "8u511",
                "product": {
                  "name": "Oracle Java SE 8u511",
                  "product_id": "T061773-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:java_se:8u511"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8u511-perf",
                "product": {
                  "name": "Oracle Java SE \u003c8u511-perf",
                  "product_id": "T061774"
                }
              },
              {
                "category": "product_version",
                "name": "8u511-perf",
                "product": {
                  "name": "Oracle Java SE 8u511-perf",
                  "product_id": "T061774-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:java_se:8u511-perf"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c11.0.33",
                "product": {
                  "name": "Oracle Java SE \u003c11.0.33",
                  "product_id": "T061776"
                }
              },
              {
                "category": "product_version",
                "name": "11.0.33",
                "product": {
                  "name": "Oracle Java SE 11.0.33",
                  "product_id": "T061776-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:java_se:11.0.33"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c17.0.21",
                "product": {
                  "name": "Oracle Java SE \u003c17.0.21",
                  "product_id": "T061777"
                }
              },
              {
                "category": "product_version",
                "name": "17.0.21",
                "product": {
                  "name": "Oracle Java SE 17.0.21",
                  "product_id": "T061777-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:java_se:17.0.21"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c21.0.13",
                "product": {
                  "name": "Oracle Java SE \u003c21.0.13",
                  "product_id": "T061778"
                }
              },
              {
                "category": "product_version",
                "name": "21.0.13",
                "product": {
                  "name": "Oracle Java SE 21.0.13",
                  "product_id": "T061778-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:java_se:21.0.13"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c25.0.5",
                "product": {
                  "name": "Oracle Java SE \u003c25.0.5",
                  "product_id": "T061779"
                }
              },
              {
                "category": "product_version",
                "name": "25.0.5",
                "product": {
                  "name": "Oracle Java SE 25.0.5",
                  "product_id": "T061779-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:java_se:25.0.5"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c27.0.1",
                "product": {
                  "name": "Oracle Java SE \u003c27.0.1",
                  "product_id": "T061781"
                }
              },
              {
                "category": "product_version",
                "name": "27.0.1",
                "product": {
                  "name": "Oracle Java SE 27.0.1",
                  "product_id": "T061781-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:java_se:27.0.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Java SE"
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-91403",
      "product_status": {
        "known_affected": [
          "T061777",
          "67646",
          "T061778",
          "T061779",
          "978054",
          "2951",
          "T061773",
          "T061784",
          "T048255",
          "T061774",
          "398363",
          "777623",
          "T061787",
          "T061776",
          "T061781",
          "T061782",
          "T061783"
        ]
      },
      "release_date": "2026-10-22T22:00:00.000+00:00",
      "title": "CVE-2026-91403"
    }
  ]
}

CVE-2026-91403 (GCVE-0-2026-91403)

Vulnerability from cvelistv5 – Published: 2026-10-21 21:23 – Updated: 2026-10-24 20:01

Summary

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-23 03:55 UTC

CWE

Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.
CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Assigner

oracle CNA under the mitre root

CNA scorecard C 69/100 over 3981 records in the last 180 days details

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/alert-cve-…	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Oracle Corporation	Oracle Java SE	Affected: 8u511 Affected: 8u511-perf Affected: 11.0.33 Affected: 17.0.21 Affected: 21.0.13 Affected: 25.0.5 Affected: 27.0.1
Oracle Corporation	Oracle GraalVM for JDK	Affected: 17.0.21 Affected: 21.0.13
Oracle Corporation	Oracle GraalVM Enterprise Edition	Affected: 21.3.20

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91403",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-23T03:55:22.386911Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-327",
                "description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-24T20:01:56.993Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Oracle Java SE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8u511"
            },
            {
              "status": "affected",
              "version": "8u511-perf"
            },
            {
              "status": "affected",
              "version": "11.0.33"
            },
            {
              "status": "affected",
              "version": "17.0.21"
            },
            {
              "status": "affected",
              "version": "21.0.13"
            },
            {
              "status": "affected",
              "version": "25.0.5"
            },
            {
              "status": "affected",
              "version": "27.0.1"
            }
          ]
        },
        {
          "product": "Oracle GraalVM for JDK",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "17.0.21"
            },
            {
              "status": "affected",
              "version": "21.0.13"
            }
          ]
        },
        {
          "product": "Oracle GraalVM Enterprise Edition",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "21.3.20"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u511:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:8u511:*:*:*:enterprise_performance:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:11.0.33:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:17.0.21:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:21.0.13:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:25.0.5:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:java_se:27.0.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.21:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.13:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:graalvm:21.3.20:*:*:*:enterprise:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and  21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T21:23:28.057Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/alert-cve-2026-91403.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-91403",
    "datePublished": "2026-10-21T21:23:28.057Z",
    "dateReserved": "2026-09-14T22:10:16.632Z",
    "dateUpdated": "2026-10-24T20:01:56.993Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted