CVE-2026-91398

What it actually does

Improper input validation in the Networking component when handling SOCKS5 traffic allows an unauthenticated remote attacker to bypass intended controls and perform unauthorized creation, deletion, or modification of critical data; the vulnerability also permits scope change to additional products.

Why it matters to the business

Successful exploitation can result in tampering with data processed by Java runtimes across server, client, and sandboxed applet deployments, potentially affecting downstream applications and requiring urgent patching despite low exploit probability.

How an attack unfolds

An attacker with network access crafts malicious SOCKS5 protocol messages and sends them to a vulnerable Java process; the improper validation flaw is triggered through standard APIs, enabling integrity violations on data accessible to the Java runtime, including in sandboxed environments that load untrusted code.

How to fix it

Upgrade Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition to the latest versions that resolve the networking component flaw as soon as vendor patches become available; restrict unnecessary network exposure of SOCKS5 endpoints and review sandbox policies for untrusted code.

How to confirm the fix worked

Inventory all Java installations and compare running versions against the affected list (8u503 and earlier, 11.0.32.1 and earlier, etc.); after applying updates, re-test SOCKS5-handling code paths and confirm no residual vulnerable binaries remain.

Typical attack path

1. Identify exposed Java processes accepting SOCKS5 connections or reachable via SOCKS5 proxies.
2. Craft and transmit malformed SOCKS5 requests that trigger the validation flaw.
3. Leverage successful exploitation to create, modify, or delete critical data within the Java application's scope.
4. Extend impact to additional products due to the reported scope change.

How to detect it

Review network logs for anomalous SOCKS5 traffic patterns targeting Java processes; inspect application logs for unexpected data modification events originating from networking APIs; correlate with any outbound connections that bypass normal validation.

What your security team should do

• Prioritize patching within the next maintenance window given the four-day publication age and potential scope change.
• Monitor EPSS and KEV status for any rise in exploit maturity.
• Limit network accessibility of Java processes that rely on SOCKS5.
• Review and harden sandbox configurations for Web Start and applet deployments.