CVE-2026-91332

What it actually does

Improper input validation in the Networking component permits unauthenticated remote attackers to supply crafted data via multiple protocols or APIs, resulting in unauthorized modification (insert/update/delete) of accessible application data without affecting confidentiality or availability.

Why it matters to the business

Attackers can silently alter data processed by Java applications or sandboxed applets, potentially leading to corrupted records, tampered transactions, or manipulated outputs in client-side or server-side deployments; low exploitation likelihood and four days since disclosure keep immediate operational risk modest.

How an attack unfolds

An attacker sends specially crafted network requests or supplies malicious data through exposed Java APIs (such as those used by web services) that reach the vulnerable Networking component; because input validation fails, the malformed data is accepted and causes unauthorized changes to in-scope data structures before any further processing occurs.

How to fix it

Apply the latest Oracle Critical Patch Update that addresses this issue for each affected Java SE and GraalVM version; disable or restrict network-accessible APIs where possible until patches are deployed; monitor Oracle release notes for exact per-version fixes as they become available.

How to confirm the fix worked

After patching, confirm the updated Java version string no longer matches the listed vulnerable releases and test that previously successful malformed inputs are now rejected; re-run application-specific API tests to verify integrity controls function as expected.

Typical attack path

1. Identify a reachable Java SE or GraalVM instance exposing Networking APIs or handling untrusted input.
2. Craft and transmit network payloads or API calls containing invalid or maliciously formed data.
3. Trigger the improper validation path to achieve unauthorized data modification.
4. Observe or leverage the resulting data changes for further impact.

How to detect it

Search application and network logs for repeated malformed requests to Java Networking APIs or unusual data modification patterns originating from untrusted sources; correlate with sandboxed applet or Web Start execution events if untrusted code is loaded.

What your security team should do

• Prioritize patching Oracle Java SE and GraalVM deployments within standard change windows given the low EPSS and absence from KEV.
• Review and restrict exposure of Networking APIs or sandboxed Java code that accepts external input.
• Update vulnerability scanning policies to flag the affected versions until remediation is complete.