Oracle Security Alert CVE-2026-91403 (CVSS 9.1): Oracle Java SE and GraalVM flaw in the JSSE component is remotely exploitable without authentication

Oracle published Security Alert CVE-2026-91403 (Rev 1) on 21 October 2026 for a vulnerability in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition. Oracle says the flaw is remotely exploitable without authentication over multiple protocols and scores it CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N); Oracle's CVE record says successful attacks can result in unauthorised creation, deletion or modification of critical data or all data accessible to these products, as well as unauthorised access to critical data or complete access to all accessible data. The supported versions Oracle lists as affected are Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, Oracle GraalVM for JDK 17.0.21 and 21.0.13, and Oracle GraalVM Enterprise Edition 21.3.20. Oracle says the flaw can be exploited through APIs in the component, for example through a web service that supplies data to them, and also applies to sandboxed Java Web Start applications or applets that load and run untrusted code. Oracle's alert does not describe the bug, credits no reporter and points to its Java SE Patch Availability Document for patches; the alert page does not list fixed build numbers or say whether the flaw has been exploited.

Product

Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition (component: JSSE)

Versions

Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK 17.0.21, 21.0.13; Oracle GraalVM Enterprise Edition 21.3.20 (supported versions listed by Oracle; earlier versions likely also affected, per Oracle). As of 22 Oct.

CVSS

9.1 Critical (CVSS 3.1, Oracle)

Exploited in Australia?

unknown

Patch to

Apply the Java SE patches listed in Oracle's Patch Availability Document linked from the alert. Oracle provides Security Alert patches only for versions in Premier or Extended Support and says earlier, unsupported releases are likely also affected, so move those to a supported version.

Primary: Oracle — Security Alert Advisory CVE-2026-91403 (Rev 1, 21 Oct 2026) · Vendor: CVE record CVE-2026-91403 (Oracle, published 21 Oct 2026) · CVE: CVE-2026-91403

vulnerabilities