Oracle Java SE and GraalVM JSSE flaw lets unauthenticated attackers read and modify data (CVE-2026-91403)

What happened

Oracle describes this as an easily exploitable critical vulnerability in the JSSE component of Oracle Java SE and Oracle GraalVM. The CVSS 3.1 score is 9.1, with a vector indicating a network attack, low complexity, no privileges required and no user interaction. An unauthenticated attacker with network access via multiple protocols can read critical data or create, delete or modify it. Availability is not affected.

The vulnerability is classed under CWE-327, use of a broken or risky cryptographic algorithm. Oracle notes that it can be exploited through APIs in JSSE, for example through a web service that supplies data to those APIs, and that it also applies to Java deployments that load and run untrusted sandboxed code, such as Java Web Start applications or applets relying on the Java sandbox.

No exploitation or public disclosure is recorded in the sources for this advisory, and the issue is not listed in CISA's KEV catalogue.

Who is affected

Affected releases are Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1; Oracle GraalVM for JDK 17.0.21 and 21.0.13; and Oracle GraalVM Enterprise Edition 21.3.20.

Java SE is the general-purpose Oracle runtime used across server and client workloads, while GraalVM for JDK and GraalVM Enterprise Edition are JDK builds with GraalVM capabilities. The same JSSE component is affected across these products. Check both standalone Java installations and Java runtimes bundled inside vendor applications.

What to do now

1. Inventory all Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition deployments, including runtimes bundled with applications.
2. Apply Oracle's fix. Oracle has published a security alert and indicates fixes are available; fixed version numbers are not given in this advisory, so confirm the exact build for your update level there.
3. If immediate patching is not possible, restrict network access to services that call JSSE APIs, especially web services or applications that accept untrusted data or run sandboxed Java code. This is temporary containment, not a substitute for patching.
4. After patching, review affected systems for unexpected data changes, since this vulnerability allows unauthorized modification of data.

How to detect it

Oracle's advisory does not list specific indicators of compromise. Prioritise identifying network-exposed Java services that call JSSE APIs, and monitor for unexpected read or modification of data handled by affected Java components.

Beyond the patch

This is not only a Java upgrade problem: Java runtimes are frequently bundled inside supplier products, so knowing every place an affected version runs is a supply-chain risk first. Supply Chain Defense & Third-Party Risk helps track which vendors' software you run and how their patch cycles set your exposure window. Because the flaw is reachable without credentials, an exposure review of internet-facing Java services is also worth running through Virtual CISO Services (vCISO).