Oracle Java SE CVE-2026-91332

Exploitation requires that attacker-controlled data reaches the affected Oracle Java SE Networking component APIs - Oracle notes this is typically done 'through a web service which supplies data to the APIs,' so the deployed application must expose those Networking APIs to untrusted input. The vulnerability also applies to client deployments: sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code (e.g., from the internet) and rely on the Java sandbox for security. No authentication is required (PR:N) and no user interaction is needed (UI:N). Limiting factors: there must be an application path that feeds attacker data into the Networking APIs, or a client must run untrusted sandboxed Java code (a deployment model that is increasingly rare as browser applet/Web Start support has been removed). Affected versions are specific: Oracle Java SE 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; GraalVM for JDK 17.0.20.1 and 21.0.12.1; GraalVM Enterprise Edition 21.3.19.1.1.

This is a medium-severity issue (CVSS 3.1 base 5.3) whose signals are consistent but modest. The vector AV:N/AC:L/PR:N/UI:N indicates a network-reachable, low-complexity, unauthenticated attack, which Oracle characterizes as 'easily exploitable' - favoring real-world exploitability. However, impact is sharply constrained: C:N/I:L/A:N means only a partial (Low) integrity impact - 'unauthorized update, insert or delete access to SOME accessible data' - with no confidentiality or availability loss and no scope change (S:U). No EPSS score was supplied, the CVE is NOT listed in CISA KEV, and no public POC is indicated, so there is no evidence of active or imminent exploitation. There is no SSVC decision data provided. Net assessment: this is a genuine but low-to-moderate priority - the easy network reachability warrants patching in the normal Oracle Critical Patch Update cycle rather than emergency action, because the limited integrity-only impact caps the damage. One conflict to flag explicitly: the input Tags include 'Authentication Bypass,' but the CVSS vector (C:N/I:L/A:N, partial integrity only) and the description (unauthorized modification of some data) do not describe an authentication bypass - treat that tag as unverified and rely on the CVSS/description characterization instead.

An unauthenticated attacker sends crafted data over the network to an application that passes attacker-controlled input into the affected Java SE Networking APIs (for example, via a web service), triggering the flaw to make unauthorized updates, inserts, or deletes to some data accessible to the Java process. In the client case, a sandboxed Java Web Start application or applet that loads untrusted internet code could be used as the vector. No public exploit code is identified at time of analysis, and the impact is limited to partial data integrity - no code execution or data disclosure is implied by the CVSS vector.