Cloudanix VulnDB

CVE-2026-91415

High · 7.0

CVSS

7.0

EPSS

0.2%

Published

Oct 20, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in widely used Java software can let remote attackers crash applications or tamper with some data, and organizations should install the vendor's security updates promptly.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
High
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Flaw in the 2D component allows crafted input via network-accessible APIs or protocols to trigger repeated crashes or hangs while also permitting limited unauthorized data modification and read operations.

Why it matters to the business

Java-dependent applications and services can experience sudden unavailability and partial data integrity or confidentiality loss, increasing operational downtime and remediation effort across widely deployed environments.

How an attack unfolds

An unauthenticated attacker reaches the vulnerable 2D APIs over any supported network protocol, supplies malicious data that triggers the flaw, and achieves repeated denial of service along with limited data tampering and disclosure.

How to fix it

Apply the latest Oracle Critical Patch Update that resolves the issue in the 2D component for all affected Java SE, GraalVM for JDK, and GraalVM Enterprise Edition versions; test and deploy updated runtimes in all environments including sandboxed applets and Web Start applications.

How to confirm the fix worked

Verify runtime versions against the fixed releases published in the Oracle CPU; perform functional testing of 2D operations under load and review process stability logs after upgrade.

Typical attack path

  1. Identify reachable Java SE or GraalVM deployments exposing 2D component APIs
  2. Craft and transmit malicious input through web services or other data-supplying interfaces
  3. Trigger the parsing or processing flaw to induce crash or hang
  4. Leverage side effects for limited unauthorized data update or read operations

How to detect it

Review Java process crash and hang logs, monitor for repeated 2D component failures correlated with inbound network connections, and inspect application error logs for unexpected data access anomalies.

What your security team should do

  • Prioritize patching of internet-facing and client-facing Java deployments within standard change windows given the five-day publication window
  • Inventory all Oracle Java SE and GraalVM instances to confirm exposure
  • Monitor for anomalous Java process terminations or hangs until patches are applied

The record

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition as well as unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities