Log in Request a demo

Vulnerability

Oracle Java SE JSSE Vulnerability (CVE-2026-91403)

A critical vulnerability in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition.

CVE ID
CVE-2026-91403
CVSS
9.1 Critical (CVSS v3.1, Oracle)
Affected product
Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition (component JSSE)
Exploited
Unknown
Published
21 October 2026

In short

CVE-2026-91403 is a critical vulnerability in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition. Oracle says an unauthenticated attacker with network access could gain read and write access to critical data. It is rated CVSS 9.1. Oracle released it as an out-of-band Security Alert on 21 October 2026 and does not say that it is exploited.

Profile MapVulnerability
  1. CVECVE-2026-91403
  2. ProductOracle Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition (component JSSE)
  3. Fix Steps5actions listedFind where Java runs · Get the patch from Oracle

What it allows

Oracle describes an easily exploitable flaw in the JSSE component, the part of Java that handles secure network connections. An unauthenticated attacker with network access, through multiple protocols, could compromise the product. Oracle says a successful attack can result in unauthorized creation, deletion or modification of critical data, and unauthorized access to critical data. The CVSS vector is network, low complexity, no privileges, no user interaction, with high impact on confidentiality and integrity and none on availability.

Oracle adds a note on how the flaw is reached. It can be exploited by using the APIs in the JSSE component, for example through a web service that passes data to those APIs. It also applies to Java deployments that load and run untrusted code and rely on the Java sandbox for security. Oracle names sandboxed Java Web Start applications and sandboxed applets as typical cases, mostly on clients.

Oracle does not publish more technical detail, and the alert names no reporter. It does not say whether the flaw is being exploited. We also checked the CISA Known Exploited Vulnerabilities catalog on 22 October 2026, and the CVE is not listed. That can change quickly.

Who is affected

Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1. Oracle GraalVM for JDK 17.0.21 and 21.0.13. Oracle GraalVM Enterprise Edition 21.3.20.

Oracle tests only versions that are under Premier Support or Extended Support. It says earlier versions are likely affected too and recommends upgrading to a supported version.

The alert does not name fixed version numbers. For each affected product it points to a Java SE patch availability document, which holds the patch information and install steps. Use that document, not a guess, to pick the build to install.

Timeline

  1. 20 Oct 2026

    Oracle's release notes give 20 October 2026 as the release date of JDK 21.0.13, one of the versions the later alert lists as affected.

  2. 21 Oct 2026

    Oracle publishes Security Alert CVE-2026-91403 as revision 1, rates the flaw CVSS 9.1 and lists the affected Java SE and GraalVM versions. The alert credits no reporter.

  3. 21 Oct 2026

    The NVD record is published at 22:16 UTC, with Oracle as the source of the CVSS score.

  4. 22 Oct 2026

    The Hong Kong CERT (HKCERT) publishes a bulletin that lists the same affected versions and points to the Oracle alert for the fix.

What to do

  1. Find where Java runs

    List every system that runs Oracle Java SE or GraalVM, with the exact version. Compare it with the versions in the alert. Include application servers, build servers and desktops that run Java applications.

  2. Get the patch from Oracle

    Open the Oracle Java SE patch availability document that the alert links to. It names the patch and gives the install steps. Oracle patches only versions under Premier or Extended Support, so an older release needs an upgrade.

  3. Rank by exposure

    Start with Java services that take data from the network and use secure connections, such as web services. The alert says the flaw can be reached through a web service that passes data to the JSSE APIs. Then cover clients that run untrusted sandboxed code.

  4. Check other Java vendors

    The alert covers Oracle Java SE and GraalVM. If you run a Java build from another vendor, read that vendor's own notice for its fix.

  5. Watch for changes

    Check the Oracle alert, the NVD record and the CISA catalog again over the coming days. Oracle may revise the alert, and CISA may add the CVE if exploitation is seen.

Questions

What is CVE-2026-91403?

It is a critical flaw in the JSSE component of Oracle Java SE and GraalVM. An unauthenticated attacker with network access could read and change critical data. Oracle rates it CVSS 9.1 and published it as a Security Alert on 21 October 2026.

Is CVE-2026-91403 being exploited?

Oracle's alert does not say so, and the CVE was not in the CISA Known Exploited Vulnerabilities catalog when we checked on 22 October 2026. Treat it as urgent anyway, because it needs no login and no user action.

Which Java versions are affected?

Oracle lists Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, plus GraalVM for JDK 17.0.21 and 21.0.13 and GraalVM Enterprise Edition 21.3.20. Earlier versions are likely affected too.

Where do I get the fix?

Oracle's alert links to a Java SE patch availability document with the patch and install steps. The alert itself does not list fixed version numbers.

Is this part of the October 2026 Critical Patch Update?

No. It is a separate out-of-band Security Alert, published on 21 October 2026, a day after the Critical Patch Update of 20 October. It needs its own patching step.

Does it affect Java in the browser?

Oracle says it also applies to sandboxed Java Web Start applications and applets that load untrusted code and rely on the Java sandbox. On servers, Oracle says it can be reached through the JSSE APIs, for example through a web service that supplies data to them.

In our research

  1. Next.js and Node.js Security Updates, October 2026: What to Patch First October 2026
  2. Oracle October 2026 Critical Patch Update: What to Patch First October 2026
  3. CVSS, EPSS and CISA KEV: what each signal tells you October 2026
  4. A Cryptographic Security Vulnerability Detected in Java: “Psychic Signatures” April 2022

Sources

  1. Oracle Security Alert Advisory - CVE-2026-91403 Oracle
  2. Text Form of Oracle Security Alert - CVE-2026-91403 Risk Matrices Oracle
  3. CVE-2026-91403 NVD
  4. Oracle Java Security Restriction Bypass Vulnerability HKCERT
  5. Known Exploited Vulnerabilities catalog CISA
  6. JDK 21.0.13 release notes Oracle

Last updated 22 October 2026

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Common Vulnerability Scoring System (CVSS)

The Common Vulnerability Scoring System (CVSS) is an open standard for describing the severity of a software vulnerability as a number from 0.0 to 10.0.

Read more

Glossary term

Sandbox

A sandbox is a restricted, controlled environment where software can run without reaching the rest of a system.

Read more