Oracle Java SE CVE-2026-91374

Exploitable only against deployments that expose the affected Serviceability component's APIs to attacker-reachable input - typically a web service or application that supplies external data to those Java/GraalVM APIs over one of the supported protocols. The primary limiting factor is the HIGH attack complexity (AC:H), which Oracle characterizes as 'difficult to exploit,' meaning success requires conditions beyond the attacker's control. A distinct, now-legacy scenario applies to clients running sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code and depend on the Java sandbox; this requires the deprecated Web Start/applet deployment model to be in use. No authentication is required (PR:N) and no user interaction is needed (UI:N), but impact is confined to partial confidentiality and integrity with no availability effect.

This is a genuinely moderate-severity, low-priority issue despite the ubiquity of the affected platform. The CVSS 3.1 base score is 4.8 (MEDIUM) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N: network-reachable and unauthenticated (PR:N) but with HIGH attack complexity (AC:H), which Oracle itself describes as 'difficult to exploit.' Impact is limited to partial confidentiality and integrity (C:L/I:L) with no availability impact (A:N) - an attacker can achieve unauthorized read of a subset of data plus unauthorized update/insert/delete of some data, not full compromise. No EPSS score, no CISA KEV listing, and no public POC were supplied in the input, so there is no signal of active or imminent exploitation. There is no SSVC decision data provided. The signals are internally consistent: a network vector paired with high complexity and only partial impact points to a real but hard-to-exploit flaw rather than a mass-exploitation candidate. Note the input Tag 'Authentication Bypass' conflicts with the description, which describes a Serviceability data-exposure/manipulation flaw, not an authentication bypass - treat that tag as suspect and verify against Oracle's October 2026 CPU advisory. CWE is listed as N/A, so the precise weakness class is unconfirmed.

A remote, unauthenticated attacker sends specially crafted data to an exposed Serviceability API - for example, through a web service that forwards attacker-controlled input to the affected Java/GraalVM APIs over one of several supported protocols - to read a subset of accessible data and to make unauthorized updates, inserts, or deletions to some data. The high attack complexity means success depends on specific conditions outside the attacker's control, and no public exploit code was identified in the provided data. A secondary vector applies to sandboxed Java Web Start apps or applets that load untrusted code and rely on the Java sandbox.