Oracle Java SE CVE-2026-91379

Exploitation is confined to Java deployments that load and run untrusted code and rely on the Java sandbox - specifically sandboxed Java Web Start applications or sandboxed Java applets (e.g., code delivered from the internet). It does NOT apply to typical server deployments that run only trusted, administrator-installed code. Limiting factors are significant: the attacker needs local logon to the infrastructure (AV:L), attack complexity is High (AC:H, meaning conditions beyond the attacker's control must be met), and successful attacks REQUIRE active human interaction from a victim other than the attacker (UI:R) to load and execute the malicious applet/Web Start content. Impact is restricted to integrity (data creation/deletion/modification); there is no confidentiality or availability impact. The deprecated status of applet/Web Start technology in modern JREs further narrows real-world exposure.

Signals are consistent and point to a genuinely LOW-priority issue despite the product's ubiquity. The Oracle-supplied CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N, base 4.7, Medium) describes a local-vector, high-complexity, integrity-only flaw requiring victim interaction, with no confidentiality or availability impact. No EPSS score, CISA KEV listing, POC, or SSVC data was provided in the input, so there is no evidence of exploitation: this is no public exploit identified at time of analysis. The AV:L with PR:N combination is characteristic of Oracle's phrasing 'unauthenticated attacker with logon to the infrastructure' plus 'human interaction from a person other than the attacker' - i.e., a client-side sandbox-escape class issue in deprecated Java Web Start/applet deployments, not a remotely reachable server flaw. The one notable conflict is the input Tag 'Authentication Bypass,' which contradicts both the description (a sandbox/integrity bypass affecting JDK tools, not authentication) and the vector (no privilege or confidentiality dimension) - treat that tag as erroneous. Net: high-footprint product, but low real-world risk because the vulnerable deployment mode is legacy and exploitation requires local delivery, user interaction, and high attack complexity.

An attacker crafts a malicious Java Web Start application or applet containing untrusted code and lures a victim into loading and running it in a browser/JRE that still relies on the Java sandbox. Because of high attack complexity and the requirement that the victim actively run the code, successful exploitation is difficult; it yields only unauthorized modification/creation/deletion of data (integrity impact), with no confidentiality or availability loss. No public exploit code was identified in the provided intelligence.