Cloudanix VulnDB

CVE-2026-91394

Medium · 5.9

CVSS

5.9

EPSS

0.4%

Published

Oct 20, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in certain Java versions could let remote attackers read private information from applications without needing any login credentials.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
High
Impact
Data Exposure
Component
Library
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability in the Networking component permits an unauthenticated remote attacker to read critical or all accessible data from affected Java SE and GraalVM for JDK deployments via multiple network protocols.

Why it matters to the business

Exposure of sensitive application data could lead to confidentiality breaches, compliance violations, and loss of customer trust, though exploitation difficulty and low EPSS reduce immediate likelihood.

How an attack unfolds

An attacker with network access crafts requests using APIs in the Networking component to bypass access controls and retrieve protected data; the issue also affects sandboxed Java clients loading untrusted code from the internet.

How to fix it

Apply available security updates for Oracle Java SE and GraalVM for JDK as soon as released by Oracle; restrict network exposure of affected services and enforce least-privilege access to data.

How to confirm the fix worked

Verify Java version strings against Oracle advisory lists, scan for vulnerable installations using standard inventory tools, and confirm network controls block unauthenticated access to the component.

Typical attack path

  1. Locate exposed Oracle Java SE or GraalVM deployments on the network
  2. Identify use of affected versions in the Networking component
  3. Send crafted network requests or API calls to trigger unauthorized data access
  4. Exfiltrate critical or all accessible data without authentication

How to detect it

Review network logs for unusual API calls or requests to Java services, inspect application logs for unexpected data access patterns, and correlate with any outbound data transfers from Java processes.

What your security team should do

  • Prioritize patching once fixed versions are published given the 4-day-old disclosure
  • Limit network accessibility of Java services to trusted sources only
  • Review and harden sandbox configurations for any client-side Java deployments
  • Monitor Oracle security alerts for exact per-version fixes

The record

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities