Cloudanix VulnDB

CVE-2026-91379

Medium · 4.7

CVSS

4.7

EPSS

0.1%

Published

Oct 20, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A recently disclosed weakness in certain Java software could let someone with physical access to a computer trick another user into allowing unauthorized changes to important data.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
High
Impact
Data Tampering
Component
Library
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Improper input validation in JDK tools allows an attacker to achieve unauthorized modification of critical data when untrusted code is loaded in a sandboxed Java environment.

Why it matters to the business

Potential tampering with data processed by Java applications that run untrusted code, increasing risk of integrity loss in client-side deployments; low urgency given very low exploit probability and no known active campaigns.

How an attack unfolds

An attacker with local logon access crafts malicious input that leverages the validation flaw in a JDK tool; a separate user must then interact with the affected Java application (such as a sandboxed applet) for the integrity violation to succeed.

How to fix it

Apply the latest Oracle Critical Patch Update that addresses this issue in the affected Java SE, GraalVM for JDK, and GraalVM Enterprise Edition releases; restrict execution of untrusted code where possible and monitor Oracle advisory releases for exact fixed versions.

How to confirm the fix worked

Verify installed Java versions against the latest Oracle security updates; confirm that sandboxed deployments no longer permit the described integrity impact after patching.

Typical attack path

  1. Obtain local logon to the target system hosting the Java runtime
  2. Place or deliver untrusted code that triggers the flawed JDK tool component
  3. Rely on a separate user to interact with the sandboxed application
  4. Achieve unauthorized creation, deletion, or modification of data

How to detect it

Review system and application logs for unexpected data modifications originating from sandboxed Java processes; correlate local access events with Java tool invocations around the time of suspected activity.

What your security team should do

  • Prioritize patching Java runtimes in client environments that execute untrusted code within the next maintenance window
  • Review and reduce reliance on sandboxed Java applets or Web Start applications
  • Monitor Oracle CPU publications for the specific fixed builds once released

The record

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JDK tools). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities