Oracle Java SE CVE-2026-91375

Exploitation requires the attacker to have local logon access to the infrastructure where Oracle Java SE executes (AV:L) and depends on human interaction from a person other than the attacker (UI:R), with high attack complexity (AC:H). The specific vulnerable surface is the Libraries component reached via its APIs - for example a web service that supplies data to those APIs - and, per Oracle's note, the classic risk case is sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code from the internet and rely on the Java sandbox for security. LIMITING FACTORS: no authentication is needed (PR:N) but local access plus victim interaction and difficult-to-reproduce conditions sharply constrain real-world exploitation; server-side deployments that do not load untrusted code and the deprecated/removed applet-and-Web-Start model mean many modern JDK deployments are not meaningfully exposed.

This is a genuinely low-priority issue despite the 'Authentication Bypass' tag suggesting otherwise. The CVSS 3.1 base score of 4.7 (MEDIUM) is well-calibrated to the vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N: exploitation requires local logon to the infrastructure (AV:L), is difficult (AC:H), and depends on human interaction from a victim other than the attacker (UI:R). Impact is limited to integrity (I:H) with no confidentiality or availability consequences (C:N/A:N). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so the exploitation status is: no public exploit identified at time of analysis. SSVC-style signals reinforce low urgency - not automatable (requires human interaction and high attack complexity) and technical impact is partial (integrity only). The classic Oracle caveat applies: the flaw is most relevant to the increasingly rare sandboxed Java Web Start / applet deployment model that loads untrusted code. CONFLICT TO NOTE: the 'Authentication Bypass' tag contradicts the actual vector (PR:N already means no authentication is required, and the impact is integrity corruption, not auth circumvention) - treat the tag as inaccurate. The AV:L vector combined with the 'web service which supplies data to the APIs' note is also worth verifying with Oracle, as that phrasing can imply a remote data path even though Oracle scored it local.

An attacker with the ability to supply crafted data to a vulnerable Java SE API - for example via a local web service endpoint that feeds the affected Libraries component, or a sandboxed Java Web Start application / applet that loads attacker-controlled untrusted code - induces a victim to process that data. The high-complexity flaw is then triggered to corrupt, create, or delete critical application data. No public exploit code is identified at time of analysis, and the attack requires both a local vector and human interaction, making opportunistic exploitation unlikely.