Oracle Java SE CVE-2026-91403

Exploitation requires the target to run a vulnerable Java SE / GraalVM version (Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; GraalVM for JDK 17.0.21/21.0.13; GraalVM EE 21.3.20) and to expose the JSSE component to attacker-controlled data - per Oracle, 'by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs.' No authentication, user interaction, or non-default configuration is required for the primary server-side vector (AV:N/AC:L/PR:N/UI:N). A secondary vector applies to Java deployments running sandboxed Java Web Start applications or sandboxed applets that load untrusted code and rely on the Java sandbox; this limiting path is largely vestigial on current platforms since browser applet/Web Start support is broadly removed, so realistic risk concentrates on server-side services that feed untrusted network data into JSSE.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk paper issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, score 9.1) is internally consistent with Oracle's prose: 'easily exploitable' maps to AC:L, 'unauthenticated attacker with network access' maps to AV:N/PR:N/UI:N, and the described unauthorized read plus create/delete/modify of all accessible data maps to C:H/I:H with A:N (no availability impact). The affected component is JSSE (Java Secure Socket Extension), Java's TLS/SSL stack, which makes network reachability the default rather than the exception. Countervailing signals weaken the urgency, however: no EPSS score was supplied, the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The only source is the Oracle advisory itself (a Critical Patch Update / Security Alert entry); there is no independent NVD enrichment, no CWE classification (listed N/A), and no EPSS to gauge real-world exploitation probability. Net: treat as a priority patch for any server-side Java that terminates or initiates TLS via JSSE, but recognize that exploitation evidence is currently absent and exploitability of the secondary applet/Web Start vector is largely theoretical on modern deployments.

A remote, unauthenticated attacker interacts with a network-facing Java service whose JSSE/TLS layer processes attacker-supplied data (for example via a web service that passes data into the vulnerable APIs), abusing the flaw to read and tamper with sensitive application data without credentials. No public exploit code is known, so an attacker would need to develop their own; the low attack complexity (AC:L) means no special timing, race, or configuration hurdles once the vulnerable code path is reachable.