Cloudanix VulnDB

CVE-2026-91461

Low · 3.7

CVSS

3.7

EPSS

0.2%

Published

Oct 20, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A hard-to-exploit issue in Oracle Java could let someone on the network change small amounts of data sent over secure connections in certain setups.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
High
Impact
Data Tampering
Component
Library
Class
Cryptographic Weakness
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A flaw in the JSSE component permits an unauthenticated network attacker to achieve limited unauthorized modification of accessible data via crafted TLS interactions, though exploitation is difficult and requires direct API access without involving untrusted applets or web start applications.

Why it matters to the business

Potential for subtle data tampering in Java-based applications handling TLS connections, with low likelihood due to high attack complexity; organizations using affected Oracle Java versions across many deployments face minor integrity risks and should address promptly given Java's broad ecosystem prevalence.

How an attack unfolds

An attacker identifies a target running vulnerable Oracle Java SE or GraalVM, establishes network access, and supplies specially crafted data to JSSE APIs over TLS to bypass protections and perform limited unauthorized data modifications.

How to fix it

Upgrade affected Oracle Java SE installations to versions beyond 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 or 27; upgrade Oracle GraalVM for JDK beyond 17.0.20.1 and 21.0.12.1; upgrade Oracle GraalVM Enterprise Edition beyond 21.3.19.1.1.1 and apply all subsequent security updates from Oracle.

How to confirm the fix worked

Confirm upgraded Java runtime versions match or exceed the fixed releases, retest TLS-enabled services for expected behavior, and validate that JSSE API calls no longer permit unauthorized data changes under simulated attack conditions.

Typical attack path

  1. Scan for exposed network services using vulnerable Oracle Java versions
  2. Establish unauthenticated network access via TLS
  3. Craft and deliver malicious payload directly to JSSE component APIs
  4. Achieve limited unauthorized insert, update, or delete operations on accessible data

How to detect it

Examine application and TLS logs for anomalous JSSE API invocations or unexpected data modification patterns; correlate with network traffic showing unusual handshake or payload characteristics on Java-hosted services.

What your security team should do

  • Prioritize patching all Oracle Java SE and GraalVM deployments within the next maintenance window due to the five-day publication window
  • Inventory all Java installations and restrict direct exposure of JSSE APIs to untrusted networks
  • Monitor Oracle security advisories for any follow-on updates given stable but non-zero EPSS

The record

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities