Oracle Java SE CVE-2026-91396

Two concrete paths exist per Oracle's description. Server-side: an application must pass attacker-controlled data into the affected Utility-component APIs - e.g., a web service that supplies external input to those APIs; without such an exposed code path the flaw is not remotely reachable. Client-side: exploitation applies to Java deployments running sandboxed Java Web Start applications or sandboxed Java applets that load and execute untrusted internet code and rely on the Java sandbox - a legacy, largely-deprecated configuration. Limiting factors: although the vector is AV:N/AC:L/PR:N/UI:N, real-world server exploitation is bounded by whether the deployed application actually feeds untrusted data to the vulnerable APIs, and the client path requires the obsolete applet/Web Start sandbox model; impact is confined to partial integrity and partial availability, with no confidentiality exposure.

This is a medium-severity (CVSS 3.1 6.5) vulnerability in the Utility component of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition, with the vendor-supplied vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L indicating network-reachable, low-complexity, unauthenticated exploitation with no user interaction. Impact is limited: no confidentiality loss (C:N), only partial integrity (I:L - unauthorized update/insert/delete of some data) and partial availability (A:L - partial denial of service), which caps severity well below critical. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active exploitation or weaponization; the only source is Oracle's October 2026 Critical Patch Update. No SSVC decision data was supplied. The practical risk is tempered by Oracle's two distinct exploitation paths: server-side exploitation requires an application to feed attacker-controlled data to the affected Utility APIs (e.g., a web service), while the client-side path applies only to the largely-deprecated sandboxed Java Web Start / applet model running untrusted code - a configuration rarely present in modern deployments. Net assessment: a genuine but moderate-priority patching item, not an emergency; the AV:N 'network' rating is somewhat optimistic for the server case because it presupposes an application that exposes the vulnerable APIs to untrusted input.

An attacker supplies crafted data to a network-facing application (for example a web service) that passes the input to the affected Java Utility-component APIs, causing unauthorized modification of some application-accessible data and a partial denial of service. Alternatively, in the legacy sandboxed Java Web Start/applet model, a victim loads untrusted code from the internet that escapes the intended Utility restrictions. No public exploit identified at time of analysis.