Oracle Java SE CVE-2026-91394

Exploitation requires that attacker-controlled data reach the vulnerable Networking component APIs - for example an application or web service that passes untrusted input to those APIs - or a sandboxed Java Web Start/applet deployment that loads untrusted code and relies on the Java sandbox. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the primary limiting factor is Oracle's 'Difficult to exploit' rating (AC:H): success depends on special conditions such as precise timing, specific data flows, or attacker effort beyond a single request, and impact is limited to confidentiality (no data modification or denial of service). Affected versions are Oracle Java SE 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27 and Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1; non-affected JDK builds and applications that never route untrusted data into the Networking APIs are not exposed.

This is a moderate-severity confidentiality issue (CVSS 3.1 base 5.9) in the Networking component of Oracle Java SE and Oracle GraalVM for JDK. The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N signals a network-reachable, unauthenticated flaw (PR:N) with high confidentiality impact (C:H) but no integrity or availability impact (I:N/A:N) and no scope change. The decisive mitigating signal is AC:H ('Difficult to exploit' per Oracle), which requires special conditions such as precise timing, non-default data flows, or attacker effort beyond a single deterministic request - this is why the score lands at 5.9 rather than in the 7+ range despite being unauthenticated and network-borne. No EPSS probability, CISA KEV listing, or POC is present in the provided data, so there is no evidence of active exploitation or weaponization; exploitation status is 'no public exploit identified at time of analysis.' SSVC-style reasoning (exploitation=none observed, automatable=likely NO given AC:H, technical impact=partial since only confidentiality is affected) points to a 'Track'-level rather than 'Act'-level priority. Net: this is a credible but not urgent patch - real because it is unauthenticated and affects a ubiquitous runtime, but tempered by high attack complexity and confidentiality-only impact. Note the input Tag 'Authentication Bypass' conflicts with the description and CVSS (C:H/I:N/A:N indicates information disclosure, not an authentication/integrity bypass) - treat the tag as unreliable and rely on the Oracle description.

An unauthenticated attacker supplies crafted data to a Java application that processes it through the vulnerable Networking APIs - for example, via a web service that feeds attacker-controlled input to those APIs - and under specific conditions reads critical data the application should not expose. The flaw may also be triggered in sandboxed Java Web Start or applet deployments that load untrusted code and rely on the Java sandbox. No public exploit code is identified, and the high attack complexity means reliable exploitation requires favorable conditions rather than a single deterministic request.