CVE-2026-91333

Low · 3.7

CVSS

3.7

EPSS

0.3%

Published

Oct 20, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Certain Java versions contain a flaw that could allow a remote attacker who overcomes significant technical barriers to make unauthorized changes to some data used by Java applications.

Exploitation: Remote Unauthenticated
Attacker needs: None
Complexity: High
Impact: Data Tampering
Component: Library
Class: Authorization Bypass
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

The flaw in the Security component permits an unauthenticated network attacker to achieve unauthorized update, insert, or delete operations on some accessible data by invoking specific APIs or by supplying untrusted code that executes within a Java sandbox.

Why it matters to the business

Organizations running the affected Java versions face a risk of limited data tampering in applications that expose the component over the network or load external code, although successful exploitation remains difficult and requires specific conditions.

How an attack unfolds

An attacker locates a network-accessible Oracle Java SE deployment on one of the listed versions, then supplies crafted input through supported protocols or untrusted code loaded via Web Start or applets; the flaw in the security component is leveraged to bypass normal authorization checks and perform integrity modifications on reachable data.

How to fix it

Upgrade Oracle Java SE installations to the next available patched releases for versions 21, 25, and 27 as soon as Oracle publishes them. Until patches are released, restrict network exposure of Java services and limit the use of sandboxed applets or Web Start applications that load untrusted code.

How to confirm the fix worked

Inventory all Java SE runtimes and confirm none are running versions 21.0.12.1, 25.0.4.1, or 27; after applying updates, re-test affected API surfaces and sandbox execution paths to verify the integrity modification vector is closed.

Typical attack path

Locate an exposed Java SE instance reachable over the network
Identify an API endpoint or sandboxed execution path that reaches the Security component
Craft and deliver malicious input or untrusted code that triggers the authorization flaw
Achieve unauthorized modification of a subset of accessible data

How to detect it

Review network and application logs for unexpected calls to Java Security component APIs, monitor sandbox execution traces for untrusted code that performs data modifications, and inspect audit trails for integrity changes originating from unauthenticated network sessions.

What your security team should do

Monitor Oracle Critical Patch Updates for the availability of fixes for CVE-2026-91333
Apply network segmentation and firewall rules to limit unauthenticated access to Java endpoints
Review and harden sandbox policies for any Java Web Start or applet deployments
Prioritize remediation on internet-facing or high-value Java services given the four-day publication window

The record

Vulnerability in Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

Affected packages

Ecosystem	Package	Introduced	Fixed