Oracle Java SE CVE-2026-91335

Exploitable ONLY in Java deployments that load and run untrusted code and rely on the Java sandbox for security - specifically sandboxed Java Web Start applications and sandboxed Java applets that execute attacker-controlled code from the internet via the AWT component. It explicitly does NOT apply to server deployments that run only trusted, administrator-installed code. Exploitation is further limited by: required interaction from a human victim other than the attacker (UI:R), low-privilege access on the attacker side (PR:L), and high attack complexity (AC:H). The applet/Web Start sandbox model is deprecated and rarely enabled in current environments, which drastically narrows the real-world attack surface.

This is a low-priority, low-severity issue despite being a network-vector flaw. The vendor-supplied CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N, base 2.6) describes a difficult-to-exploit (AC:H) vulnerability requiring a low-privileged attacker (PR:L), mandatory interaction from a victim other than the attacker (UI:R), and yielding only partial confidentiality disclosure (C:L) with no integrity or availability impact. No EPSS score, CISA KEV listing, or public POC is present in the provided data, and absence of these is consistent with the low CVSS and the niche exploitation model. The description narrows real-world risk sharply: it applies only to the deprecated sandboxed Java Web Start / Java applet model running untrusted code, which is effectively unreachable in modern server and most client deployments. No signals conflict, but one tag does: the input Tags include 'Authentication Bypass', which contradicts the description - this is an unauthorized-read (information disclosure) sandbox weakness, not an authentication bypass. Overall this is a high-CVSS-field-but-low-real-risk item; treat as routine patch-cycle maintenance via Oracle's October 2026 CPU, not an emergency.

An attacker hosts a malicious sandboxed Java applet or Java Web Start application on a website and lures a victim into loading it in a legacy Java client that still honors the browser/applet sandbox. The untrusted code exploits a flaw in the AWT component to read a subset of data it should not be able to access. The attack is hard to pull off (AC:H) and requires victim interaction; no public exploit code was identified at time of analysis.