Cloudanix VulnDB

CVE-2026-91403

Critical · 9.1

CVSS

9.1

EPSS

0.4%

Published

Oct 21, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in widely used Java software lets remote attackers access or change important data without needing any login or special access.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Tampering
Component
Library
Class
Authentication Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Flaw in the JSSE component allows unauthenticated network attackers to bypass access controls and perform unauthorized creation, deletion, modification, or reading of critical data via exposed APIs or loaded untrusted code.

Why it matters to the business

Attackers can steal or alter sensitive information processed by Java applications, leading to data breaches, compliance violations, and operational disruption across widely deployed enterprise and client Java runtimes.

How an attack unfolds

An attacker sends crafted requests over network protocols to JSSE-exposed interfaces or supplies malicious code to sandboxed Java applications; the flaw permits direct unauthorized data operations without authentication or user interaction.

How to fix it

Apply the latest vendor patches for all affected Java SE, GraalVM for JDK, and GraalVM Enterprise Edition versions; disable unnecessary network-exposed JSSE interfaces and enforce strict sandboxing for untrusted code where patching is delayed.

How to confirm the fix worked

Verify that all Java installations report versions beyond the affected list (8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1 and corresponding GraalVM releases); test that previously vulnerable API endpoints now enforce authentication and reject unauthorized data operations.

Typical attack path

  1. Identify reachable Java deployments exposing JSSE APIs or accepting untrusted code
  2. Craft and send network requests or load malicious classes through web services or applets
  3. Exploit the authentication bypass to read, modify, or delete critical application data

How to detect it

Review application and web server logs for unexpected unauthenticated access attempts to JSSE-dependent endpoints or unusual data modification patterns originating from network clients; examine Java process activity for loading of untrusted classes in sandboxed environments.

What your security team should do

  • Prioritize patching all internet-facing and client Java deployments within the next 48 hours given the high severity and unauthenticated network vector
  • Inventory all Java runtimes and block execution of untrusted code until updates are applied
  • Monitor for any post-patch anomalies in data access patterns

The record

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities