CVE-2026-91375

Medium · 4.7

CVSS

4.7

EPSS

0.1%

Published

Oct 20, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A problem in certain Java software could allow someone who already has access to the computer and some help from another user to secretly change or delete important information.

Exploitation: Local Privilege
Attacker needs: Local User
Complexity: High
Impact: Data Tampering
Component: Library
Class: Improper Input Validation
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

Improper input validation in Java Libraries permits crafted inputs supplied via APIs to bypass checks and perform unauthorized creation, deletion, or modification of critical data.

Why it matters to the business

Applications built on the affected Java versions risk silent corruption or loss of important data, potentially disrupting operations and requiring recovery efforts, though exploitation is difficult and needs local access plus user interaction.

How an attack unfolds

An attacker with the ability to log on to the host running the vulnerable Java runtime supplies malicious data through a local process or API call; a separate user must then interact with the application, triggering the flaw that alters data integrity without authentication.

How to fix it

Upgrade affected Oracle Java SE, GraalVM, and GraalVM Enterprise Edition installations to the latest vendor-provided versions that resolve the issue in the Libraries component; apply updates as soon as they become available.

How to confirm the fix worked

Confirm the Java runtime version is no longer in the listed affected range, review release notes for Libraries fixes, and test API endpoints with previously exploitable inputs to verify integrity controls now enforce properly.

Typical attack path

Obtain local logon to the infrastructure hosting the Java runtime
Identify or create a process/API endpoint that feeds data to the Libraries component
Craft input that exploits the validation weakness
Wait for or induce required human interaction from another user
Observe or leverage the resulting unauthorized data modification

How to detect it

Review application and system logs for unexpected data changes originating from local processes using the Libraries APIs; correlate with user activity timestamps and look for processes invoking Java without network authentication.

What your security team should do

Prioritize inventory of all Oracle Java SE and GraalVM deployments within four days of disclosure
Schedule upgrades to patched versions immediately upon release
Restrict local logons to Java hosts and minimize unnecessary user interaction surfaces
Monitor vendor advisories for exact fixed versions and apply them enterprise-wide

The record

Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N).

Affected packages

Ecosystem	Package	Introduced	Fixed