Oracle Java SE CVE-2026-91398

Exploitation requires the affected code path to process attacker-controlled data through Java's Networking SOCKS5 proxy handling - concretely, either (a) a server-side application/web service that forwards untrusted input into the SOCKS5 APIs, or (b) the legacy path of a sandboxed Java Web Start application or applet loading untrusted code and relying on the Java sandbox. Limiting factors: Oracle rates this 'difficult to exploit' (AC:H), so specific conditions/timing are needed; impact is integrity-only (no data theft or DoS); and the applet/Web Start vector is effectively obsolete in current JDKs, so modern risk is confined to server deployments that actually invoke the SOCKS5 functionality. No authentication or user interaction is required (PR:N/UI:N).

This is a moderate-severity issue (CVSS 3.1 base 6.8) whose real-world priority is lower than the 'unauthenticated network' label might suggest. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N) confirms a network-reachable, unauthenticated flaw, but AC:H (high complexity - Oracle describes it as 'difficult to exploit') and an integrity-only impact (C:N/I:H/A:N, no data disclosure or availability loss) sharply constrain its value to attackers. The S:C scope change raises the ceiling because impact can extend to additional products, which is why Oracle scored it 6.8 rather than lower. Key corroborating signals are MISSING: no EPSS probability was provided, the CVE is NOT in CISA KEV, no public POC is referenced, and CWE is N/A - so there is no evidence of active or imminent exploitation. The dominant exploitation path described (sandboxed Java Web Start / applets loading untrusted code) is largely vestigial, since applets and Web Start were deprecated and removed from modern JDKs, meaning the realistic attack surface is narrowed to server-side code that feeds attacker-controlled data to the Networking/SOCKS5 APIs. Net assessment: a legitimate patch-in-cycle item, not an emergency; treat as medium priority pending any future EPSS/KEV escalation.

A server application passes attacker-influenced data into Java's Networking (SOCKS5) APIs - for example a web service that proxies outbound connections on behalf of callers. By crafting that input, a remote unauthenticated attacker abuses the SOCKS5 handling to perform unauthorized creation, modification, or deletion of critical data, with the scope change allowing impact on components beyond the JVM itself. No public exploit code is identified at time of analysis, and the high attack complexity means reliable exploitation requires specific conditions rather than a trivial single request.