Cloudanix VulnDB

CVE-2026-91397

Low · 3.6

CVSS

3.6

EPSS

0.1%

Published

Oct 20, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A recently disclosed issue in certain Java software could allow someone already logged into the computer to slightly change data or slow the program if they get help from another user, though the chance of success is low.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
High
Impact
Data Tampering
Component
Library
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Flaw in the Serviceability component permits unauthorized data modification and partial denial of service via API calls when an attacker has local infrastructure access and relies on separate user interaction.

Why it matters to the business

Organizations running recent Oracle Java or GraalVM deployments face low-probability risk of limited data tampering and service degradation four days after disclosure, with potential downstream impact on Java-dependent applications until patches are applied.

How an attack unfolds

An attacker with local logon access supplies crafted data to Serviceability APIs through a web service or untrusted sandboxed code; successful exploitation requires a separate user to perform an action that triggers unauthorized data changes and partial service interruption.

How to fix it

Apply the latest Oracle security updates for Java SE 8, 11, 17, 21, 25, 27 and the corresponding GraalVM releases that address the Serviceability component; restrict local access where possible until upgrades complete.

How to confirm the fix worked

Confirm running Java versions exceed the listed affected releases, review Serviceability API usage for unexpected behavior, and validate that data modification and partial DoS vectors are closed after patching.

Typical attack path

  1. Obtain local logon to the infrastructure hosting the Java runtime
  2. Deliver malicious input to Serviceability APIs via web service or sandboxed application
  3. Trigger execution through human interaction from a non-attacker user
  4. Achieve unauthorized insert/update/delete on accessible data and partial denial of service

How to detect it

Examine application and system logs for anomalous Serviceability component API invocations, unexpected data modifications, or partial service interruptions that coincide with user activity in Java environments.

What your security team should do

  • Prioritize patching of exposed Java runtimes within the next maintenance window due to recent publication
  • Limit local logon privileges on systems executing Oracle Java or GraalVM
  • Audit sandboxed Java Web Start and applet deployments for untrusted code handling
  • Monitor Oracle advisory channels for exact fixed-version releases

The record

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serviceability). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.6 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities