CVE-2026-91374

What it actually does

The flaw in the Serviceability component permits an unauthenticated network attacker to perform limited unauthorized modifications and reads on accessible data by invoking specific APIs, bypassing intended authorization controls under high attack complexity.

Why it matters to the business

Organizations running affected Java deployments face potential unauthorized changes or exposure of limited data, increasing compliance and operational risk especially in environments exposing Java APIs or running untrusted code, though exploitation difficulty limits immediate widespread impact.

How an attack unfolds

An attacker with network access crafts requests to Serviceability APIs or supplies untrusted code to sandboxed Java applications that reach those APIs, leveraging the authorization bypass to read or alter subsets of data without authentication.

How to fix it

Apply the latest vendor updates for Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition that address the Serviceability component; restrict network exposure of Java APIs and review sandbox policies for untrusted code execution.

How to confirm the fix worked

Confirm deployment of patched Java versions, scan for exposed Serviceability endpoints, and verify that API access controls prevent unauthenticated modification or read attempts.

Typical attack path

1. Identify exposed Java SE or GraalVM endpoints accepting network connections via multiple protocols
2. Craft or supply input that invokes Serviceability component APIs directly or through web services
3. Exploit the authorization weakness to perform unauthorized read or limited write operations on data

How to detect it

Examine application and API logs for unusual unauthenticated calls to Serviceability-related endpoints or patterns involving untrusted code loading that result in unexpected data access or modification attempts.

What your security team should do

• Prioritize patching Java runtimes in internet-facing or multi-tenant deployments within standard change windows
• Review and harden network access controls around Java API endpoints
• Monitor for any increase in EPSS or public exploit code given the low current exploit maturity