Oracle Java SE CVE-2026-91397

Exploitation requires either a local logon to the infrastructure where the affected JDK/GraalVM runs, or tricking a user into executing a sandboxed Java Web Start application or sandboxed Java applet that loads untrusted code through the vulnerable Serviceability component APIs (e.g., data supplied to those APIs via a web service). Limiting factors: AV:L (local, not remote network), AC:H (high complexity requiring specific conditions), and mandatory UI:R (a human other than the attacker must act). The applet/Web Start vector is largely obsolete in modern JDK releases, and server-side exploitation is confined to configurations that feed untrusted data into the Serviceability APIs, so default headless server deployments face limited exposure.

This is a genuinely low-priority vulnerability, and the signals are consistent rather than conflicting. The CVSS 3.1 base score is 3.6 (LOW), and the vector (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L) reinforces this: exploitation requires local access to the infrastructure, high attack complexity, and user interaction, yielding only partial integrity (I:L) and partial availability (A:L) impact with no confidentiality loss (C:N). While PR:N nominally indicates no privileges, Oracle's standard CPU phrasing ('unauthenticated attacker with logon to the infrastructure') means the attacker must already have a logon to the host, so real-world reach is constrained. No EPSS score, CISA KEV listing, or public POC was provided in the input; the vulnerability is not in CISA KEV and no public exploit was identified at time of analysis. The classic Oracle 'sandboxed Java Web Start/applet' note describes a largely deprecated deployment model (browser applets and Web Start have been removed/disabled in modern JDKs), further shrinking the realistic exploitation surface. Net: a real but minor hardening item, appropriate for routine patch cycles rather than emergency remediation.

An attacker with a local logon to a host running an affected JDK, or who can lure a user into running a sandboxed Java Web Start application or applet that loads untrusted code, triggers a flaw in the Serviceability component. Because success requires human interaction from someone other than the attacker and the attack complexity is high, the realistic outcome is limited unauthorized modification of some accessible data and a partial denial of service. No public exploit code is known to exist at the time of analysis.