Oracle Java SE CVE-2026-91463

Exploitable ONLY in Java client deployments that run sandboxed Java Web Start applications or sandboxed Java applets which load and execute untrusted code (e.g., code fetched from the internet) and rely on the Java sandbox for security, via the JGSS component. It explicitly does NOT apply to server deployments that load and run only trusted/admin-installed code. Exploitation is limited by HIGH attack complexity (Oracle: 'difficult to exploit'), by required human interaction from a victim other than the attacker (UI:R - the victim must actively launch the untrusted application), and by the near-obsolescence of browser applet and Web Start support in current JDK/browser versions.

This is a moderate-severity confidentiality issue (CVSS 3.1 base 5.3) whose real-world priority is LOW despite affecting an ubiquitous runtime, because the exploitability preconditions are narrow. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) combines network reach and no authentication with HIGH attack complexity and REQUIRED user interaction, and Oracle explicitly labels it 'difficult to exploit.' No EPSS score, KEV listing, or POC was provided in the input, so exploitation probability signals are absent rather than low - this is a data gap, not evidence of safety. Critically, Oracle's own note restricts applicability to sandboxed Java Web Start applications and sandboxed Java applets that load untrusted code; this deployment mode has been deprecated and largely removed from modern browsers and JDKs, so the practically exploitable population is far smaller than the raw Java install base. Server-side Java (the dominant modern use) is explicitly NOT affected. Net: a real confidentiality flaw, but low operational urgency for most environments. Note also a tag conflict - the input tags this 'Authentication Bypass,' yet the vector and description describe information disclosure (C:H, I:N) with no auth-bypass semantics; verify tag accuracy with vendor.

An attacker publishes a malicious Java Web Start application or applet on a website and lures a victim into launching it in a browser/JVM that still supports the deprecated applet/Web Start sandbox. When the victim runs the untrusted code, a flaw in the JGSS component lets the sandboxed code read confidential data it should not access. No public exploit code was identified in the provided data, and high attack complexity plus required user interaction make opportunistic mass exploitation unlikely.