Oracle Java SE CVE-2026-91452

Exploitation requires an application running on an affected JDK to expose the Oracle Java SE Networking component's APIs to attacker-supplied data, typically through a web service endpoint. Oracle explicitly states the flaw is NOT reachable via Untrusted Java Web Start applications or Untrusted Java applets - it must be reached by feeding data to the specified component's APIs server-side. While the CVSS vector is AV:N/AC:L/PR:N/UI:N (remote, unauthenticated, no interaction), the practical limiting factor is that only deployments which route untrusted input into this networking code path are exploitable; isolated JDK installs not exposing such a service are not affected. Impact is capped at partial integrity modification of some accessible data (no data disclosure, no denial of service).

This is a genuinely low-to-moderate priority issue despite affecting ubiquitous software. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3 MEDIUM) describes remote, unauthenticated, low-complexity access with NO user interaction - signals that would normally raise concern - but the impact is strictly limited to LOW integrity (C:N/A:N), meaning an attacker can cause only partial 'unauthorized update, insert or delete access to some accessible data' with no confidentiality or availability effect and no scope change. No EPSS score, KEV listing, or POC was provided in the input: there is no public exploit identified at time of analysis, and CISA has NOT listed this in KEV, so there is no evidence of active exploitation. Oracle's own 'easily exploitable' phrasing aligns with AC:L/PR:N, but the real-world impact ceiling (I:L only) caps the severity. Note a key limiting nuance the vector does not capture: the description states exploitation requires supplying data to the Networking component's APIs through a web service - so despite AV:N, the flaw is only reachable in applications that actually expose this code path to untrusted input, making this a lower practical priority than the network vector alone suggests. Treat as routine-patch-cycle (Oracle October 2026 CPU), not emergency.

An attacker with network reachability to a service built on an affected JDK sends crafted data to an application endpoint that passes it into the Java Networking component APIs (e.g. via a web service). The malformed input causes a partial integrity violation, allowing unauthorized modification, insertion, or deletion of some application-accessible data without authentication or user interaction. No public proof-of-concept is known, and confidentiality and availability are unaffected.