CVE-2026-91452

What it actually does

The networking component in affected Oracle Java SE and GraalVM releases permits unauthenticated remote callers to invoke APIs that perform unauthorized update, insert, or delete operations on some accessible data objects.

Why it matters to the business

Applications built on the listed Java releases may experience silent tampering of data they expose through network-facing APIs, increasing the risk of integrity violations and downstream corruption without requiring credentials.

How an attack unfolds

An attacker locates a network-reachable service using one of the vulnerable Java versions, supplies crafted inputs directly to the exposed networking APIs (for example via a web service), and triggers the flaw to modify data that the component can reach.

How to fix it

Upgrade Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition to the fixed releases published by Oracle once they become available; in the interim restrict network exposure of the affected APIs and apply least-privilege controls on data they can reach.

How to confirm the fix worked

Inventory all Java runtimes, compare reported versions against the vulnerable list (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27 and corresponding GraalVM releases), and re-test after applying vendor updates to confirm the networking component no longer permits the unauthorized data operations.

Typical attack path

1. Discover a reachable instance of Oracle Java SE or GraalVM exposing the affected networking APIs
2. Identify an API endpoint or service that accepts attacker-controlled data
3. Send a specially formed request or payload through the allowed protocol
4. Achieve unauthorized modification of accessible data objects

How to detect it

Review application and network logs for unexpected data modification requests directed at Java networking APIs; correlate with process execution of java or graalvmd binaries on systems running the listed versions; no specific post-exploitation artifacts are publicly documented at this time.

What your security team should do

• Treat the issue as high priority for any internet-facing or multi-tenant Java deployments
• Schedule immediate version inventory and patch deployment once fixes are released
• Temporarily block or tightly control traffic to the networking APIs until patches are applied
• Review application code that calls the affected component to reduce the attack surface