Cloudanix VulnDB

CVE-2026-91380

Medium · 4.0

CVSS

4.0

EPSS

0.1%

Published

Oct 20, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

Someone already logged into a server running certain older Java versions could read or slightly change some of the data the Java software handles.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Data Tampering
Component
Library
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Local unauthenticated access to the Utility component allows bypass of authorization checks, enabling limited unauthorized data reads plus insert/update/delete operations on accessible data via exposed APIs.

Why it matters to the business

Attackers who already have shell or infrastructure access can read or tamper with limited application data processed by affected Java runtimes, increasing risk in environments running untrusted or sandboxed code.

How an attack unfolds

An attacker with local logon uses Java APIs in the Utility component (for example through a web service feeding the APIs) to trigger the authorization flaw and perform read or limited write operations on data; the same path applies to sandboxed applets or Web Start applications loading untrusted code.

How to fix it

Apply the latest vendor security updates for Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition as soon as they become available; restrict local logon to the minimum necessary accounts and avoid running untrusted code in sandboxed Java environments.

How to confirm the fix worked

Inventory all Java runtimes and confirm versions against the affected list (8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27 and corresponding GraalVM releases); re-test after patching by attempting the documented API access patterns.

Typical attack path

  1. Obtain local logon or shell on the host running the vulnerable Java runtime
  2. Invoke targeted Utility component APIs directly or via a data-supplying web service
  3. Perform unauthorized read and limited insert/update/delete operations on accessible data

How to detect it

Review local process execution logs and Java API call traces for unexpected invocations of Utility component methods; correlate with authentication events on hosts running the listed Java versions.

What your security team should do

  • Treat as medium-priority patch item given low EPSS and difficult exploit conditions
  • Limit local interactive access to Java hosts and monitor for unusual API usage in Utility component
  • Review sandboxed Java applet/Web Start deployments and consider disabling where feasible

The record

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities