CVE-2026-91335

Low · 2.6

CVSS

2.6

EPSS

0.2%

Published

Oct 20, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A graphics-handling issue in some Java versions could let someone who tricks a user into running untrusted web code see a small amount of data they should not access.

Exploitation: Requires User Interaction
Attacker needs: Low Privilege
Complexity: High
Impact: Data Exposure
Component: Library
Class: Information Disclosure
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

The flaw permits unauthorized read access to a limited subset of accessible data within the AWT component when untrusted code executes in a sandboxed Java environment.

Why it matters to the business

Low-risk exposure of sensitive information from client-side Java applications that process code from untrusted sources, with minimal operational disruption due to exploitation difficulty and requirement for user interaction.

How an attack unfolds

An attacker crafts malicious code that leverages the AWT vulnerability; the victim must load and execute this code in a sandboxed Java applet or Web Start application over the network, enabling the attacker to read a limited data subset after successful human interaction.

How to fix it

Apply the latest Oracle Critical Patch Update to upgrade affected Java SE, GraalVM for JDK, and GraalVM Enterprise Edition installations beyond the listed vulnerable versions.

How to confirm the fix worked

Verify Java runtime versions against the affected list (8u503 and earlier point releases, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27 and matching GraalVM releases) and confirm deployment of the subsequent security update; test sandboxed applet execution in isolated environments.

Typical attack path

Identify or host a malicious Java applet/Web Start application targeting the AWT component
Deliver the payload via network protocols to a victim running a vulnerable Java deployment
Trick the victim into executing the untrusted code within the Java sandbox
Exploit the race or interaction condition to read restricted data

How to detect it

Review Java process execution logs, network access logs to untrusted applet sources, and sandbox policy violation events for unusual AWT-related data access attempts shortly after user-initiated Java application launches.

What your security team should do

Prioritize patching Java client deployments that execute untrusted code within the next maintenance window
Review and restrict Java Web Start and applet usage to trusted sources only
Monitor EPSS and exploit maturity indicators for any increase in activity

The record

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 2.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N).

Affected packages

Ecosystem	Package	Introduced	Fixed