Oracle Java SE CVE-2026-91464

Applies ONLY to Java client deployments that load and run untrusted code (sandboxed Java Web Start applications or sandboxed Java applets, e.g. code from the internet) and rely on the Java sandbox for security; it does NOT apply to server deployments that run only trusted, administrator-installed code. Exploitation further requires human interaction from a user other than the attacker (UI:R) - the victim must load/run the attacker's content - and Oracle rates it difficult to exploit (AC:H). The principal limiting factor is that the vulnerable configuration (browser applets / Web Start) is deprecated and disabled or absent in most modern environments, sharply reducing the realistically attackable population despite the ubiquity of Java itself.

Despite a C:H confidentiality rating, the real-world risk is LOW-to-MODERATE and well below what the 'critical data access' phrasing might suggest. The CVSS 3.1 base score is only 5.3 (Medium) because exploitation is gated by three independent limiters in the vector: AC:H (Oracle explicitly calls it 'difficult to exploit'), UI:R (requires a victim other than the attacker to act), and S:U (no scope change). PR:N confirms no authentication is needed, but that is offset by the requirement that the target be running the increasingly rare sandboxed applet/Java Web Start configuration. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent exploitation. The signals are internally consistent rather than conflicting: a high-confidentiality-impact but hard-to-exploit, interaction-dependent client-side flaw. The main caveat is that the product (Java SE) is ubiquitous while the vulnerable deployment mode (untrusted sandboxed code) is largely deprecated - raw prevalence overstates the attackable population. CWE is N/A and no EPSS value was supplied, so quantitative exploitation probability could not be factored in.

An attacker hosts a malicious Java applet or Java Web Start application on an internet site and lures a victim into loading it in a browser/client still configured to run untrusted sandboxed Java. When the victim runs the code, it abuses the JGSS component to escape sandbox confidentiality controls and read sensitive data accessible to the JVM. No public exploit code was identified in the provided data, and the AC:H rating indicates the attack is technically difficult to reliably reproduce.