Oracle Java SE CVE-2026-91484

Exploitation requires a Java SE 8u503 / 8u503-perf CLIENT deployment that loads and runs UNTRUSTED code via sandboxed Java Web Start applications or sandboxed Java applets and relies on the Java sandbox for security - the exact legacy plugin feature named in the advisory. The attacker must already have low-privileged logon access to the infrastructure where Java executes (PR:L, AV:L local vector), and successful exploitation is of High complexity (AC:H), meaning it depends on conditions outside the attacker's control. Explicitly NOT exploitable against server deployments that run only trusted/administrator-installed code. Limiting factors: local access needed, authenticated low-privilege context required, non-default/legacy applet-or-Web-Start usage required, and high exploit complexity - collectively making real-world exploitation difficult despite the HIGH score.

CVSS 3.1 base score is 7.5 (HIGH), but the vector (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) tempers real-world urgency: the attack is Local (AV:L), of High complexity (AC:H), and requires a low-privileged authenticated foothold (PR:L) on the host where Java executes - this is not a remote, unauthenticated, easily-weaponizable flaw. The elevated score is driven largely by the scope change (S:C) plus High confidentiality and integrity impact (C:H/I:H), with no availability impact (A:N). Per Oracle's own note, the realistic exposure is narrow: it affects only client deployments that run untrusted sandboxed Java Web Start applications or applets and rely on the Java sandbox - a legacy, largely deprecated attack surface - and does NOT apply to server deployments running only trusted code. There is no CISA KEV listing, no public POC identified, and no EPSS value supplied, so all signals point to no evidence of active or imminent exploitation. SSVC-style read: exploitation 'none' observed, not automatable (local access + high complexity), technical impact 'total' only within the affected deployment class. Net: a genuinely high-impact-if-exploited bug but low practical priority for most organizations, especially any that have already retired browser-based Java applets/Web Start. Note the input Tag 'Authentication Bypass' conflicts with the description, which describes a sandbox escape requiring an existing authenticated/low-privilege context - treat that tag as suspect.

A low-privileged user (or attacker who has gained a local foothold) on a client system lures the Java runtime into loading untrusted code through a sandboxed Web Start application or applet, then exploits the Java plugin flaw to break out of the sandbox. Because the vulnerability causes a scope change, the escape can read or modify critical data beyond the sandbox and significantly impact other products on the host. High attack complexity makes reliable exploitation difficult, and no public exploit code has been identified at time of analysis.