Oracle Java SE CVE-2026-91462

Exploitation requires an application or service that feeds attacker-supplied data into the Java JGSS (GSS-API/Kerberos) component over the network - Oracle explicitly notes it is triggered by supplying data to APIs in the component (e.g., through a web service), NOT via Untrusted Java Web Start applications or Untrusted applets. Limiting factors: high attack complexity (AC:H) means the attacker needs specific, non-trivial conditions to succeed; the deployed application must actually expose JGSS data-processing to untrusted network input; and impact is confined to data integrity (no data disclosure, no denial of service). Default JVMs that do not expose JGSS APIs to untrusted remote data are not reachable by this vector.

This is a moderate-severity integrity flaw (CVSS 3.1 base 5.9) in the JGSS component of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) signals a network-reachable, unauthenticated issue requiring no user interaction, but with high attack complexity (AC:H) and impact limited strictly to integrity (I:H; C:N, A:N). No EPSS score, CISA KEV listing, or POC was provided in the input, and no public exploit is identified at time of analysis - so the only exploitation signals are the raw CVSS metrics, which point to a difficult-to-exploit weakness rather than a mass-exploitation candidate. The AC:H rating materially lowers real-world urgency despite the unauthenticated network vector: exploitation likely demands specific conditions, timing, or data-shaping to succeed. The 'Authentication Bypass' tag is in tension with the CVSS, which models a pure integrity (I:H) impact and no scope change, not a privilege/authentication escalation - verify the precise weakness against Oracle's advisory, as the tag may be imprecise. Net assessment: patch on the normal Oracle quarterly cadence; this is a real but lower-tier priority (high prevalence of Java, offset by high exploit complexity and no confirmed exploitation or POC), not an emergency.

An application exposes Java JGSS/GSS-API processing of attacker-controlled data over the network (for example via a web service), and a remote unauthenticated attacker submits specially crafted data to that API. Because high attack complexity applies, the attacker must satisfy specific preconditions, but a successful attack lets them create, delete, or modify critical data without touching confidentiality or availability. No public exploit code is identified at time of analysis, so this remains a theoretical-but-credible network attack.