Oracle Java SE CVE-2026-91487

Exploitation requires an application that exposes the vulnerable Oracle Java SE Compiler-component APIs to attacker-supplied data, specifically through a non-sandboxed path such as a web service - Oracle explicitly notes this is NOT exploitable via Untrusted Java Web Start applications or Untrusted Java applets. The attacker needs no authentication (PR:N) and no user interaction (UI:N), but the AC:H rating means success depends on difficult, attacker-uncontrolled conditions, which substantially limits real-world exploitability. Affected builds are the specific Oracle Java SE (8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27), GraalVM for JDK (17.0.20.1, 21.0.12.1), and GraalVM EE (21.3.19.1.1) versions; unaffected or patched releases are not exposed.

This is a genuinely low-to-moderate priority issue despite being network-reachable without authentication. The CVSS 3.1 base score of 4.8 (MEDIUM) is held down by two factors visible in the vector: AC:H (Oracle's 'difficult to exploit' language, meaning the attacker needs conditions beyond their control or significant effort) and limited impact (C:L/I:L/A:N - partial read plus partial update/insert/delete to a subset of accessible data, no availability loss and no scope change). No EPSS score, KEV listing, or POC was provided in the input, and Oracle CPU advisories historically precede public exploitation by a wide margin, so there is no evidence of active exploitation. The 'Authentication Bypass' tag in the input conflicts with the actual vulnerability, which is a data-integrity/confidentiality issue in the Compiler component reachable via API data supply - treat that tag as suspect, not as a confirmed auth-bypass primitive. Net: a real but low-urgency patch item; prioritize via the normal Oracle quarterly CPU cycle rather than as an emergency, while noting that Java SE's ubiquity means even a medium flaw warrants timely patching at scale.

An unauthenticated remote attacker supplies specially crafted data to an application that exposes the vulnerable Java SE Compiler-component APIs - for example through a web service endpoint that processes attacker-controlled input - rather than via Java Web Start or applets. Because the CVSS vector is AC:H, success depends on difficult-to-achieve conditions, and a working attack yields only partial read and partial modify access to a subset of application-accessible data. No public exploit code was identified in the provided intelligence.