Oracle Java SE CVE-2026-91417

Exploitation requires that the target expose the vulnerable Oracle Java SE / GraalVM CORBA component's APIs to attacker-supplied data, for example via a CORBA/IIOP-based service or a web service that passes untrusted input into those APIs. The description explicitly states the flaw CANNOT be exploited through untrusted Java Web Start applications or untrusted Java applets - the sandboxed-client path is excluded - so a server-side or service-side CORBA data path is the required vector. Limiting factors: CORBA is a legacy, deprecated technology that is not enabled or network-exposed in most modern Java deployments, which substantially narrows the exploitable population despite the AV:N/AC:L/PR:N/UI:N vector; impact is confined to a partial denial of service (no confidentiality or integrity effect). Affected to the specific builds Oracle Java SE 8u503 / 8u503-perf and GraalVM Enterprise Edition 21.3.19.1.1.

This is a moderate-severity issue (CVSS 3.1 base 5.3) whose real-world priority is low to moderate. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) indicates network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction, which inflates the base score, but the ONLY impact is a partial denial of service (A:L) - there is no confidentiality or integrity impact. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no signal of active or imminent exploitation (no public exploit identified at time of analysis). No SSVC decision data was supplied. The data signals are internally consistent - Oracle describes it as 'easily exploitable' by an unauthenticated network attacker, matching AC:L/PR:N - but they converge on a low-urgency, availability-only flaw rather than a critical priority. One important scope limiter from the description: exploitation requires supplying data to the CORBA APIs via a service (e.g., a web service) and cannot be triggered through untrusted Java Web Start apps or applets, so only deployments that actually expose CORBA endpoints to untrusted input are at risk. CWE is listed as N/A and no EPSS is available, which are the main gaps; these are absences rather than conflicts.

An attacker with network access sends crafted data to a service that exposes the affected Java CORBA APIs (for example, an application processing IIOP/CORBA requests), triggering a condition that partially disrupts availability of the Java runtime or the hosted service. No authentication or user interaction is required, but the impact is limited to a partial denial of service rather than code execution or data compromise. No public exploit code was identified at time of analysis.