CVE-2026-91463

Medium · 5.3

CVSS

5.3

EPSS

0.2%

Published

Oct 20, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A problem in certain Java software could let someone see private information if people run programs downloaded from the internet inside a protected environment.

Exploitation: Requires User Interaction
Attacker needs: User Interaction
Complexity: High
Impact: Data Exposure
Component: Library
Class: Information Disclosure
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

Flaw in the JGSS component permits disclosure of critical or all accessible data when processing network protocols in sandboxed Java client environments that load untrusted code.

Why it matters to the business

Potential exposure of sensitive information from client systems running Java applications that interact with untrusted content, increasing compliance and data-loss risks; low exploit likelihood and no known active campaigns reduce immediate urgency.

How an attack unfolds

An attacker crafts malicious content served over network protocols; a user other than the attacker must interact with a sandboxed Java client application that loads the content, triggering the JGSS flaw to leak data back to the attacker.

How to fix it

Apply the latest vendor security updates for Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition that address this issue; restrict execution of untrusted Java content in client environments where possible.

How to confirm the fix worked

Verify that affected Java installations report versions beyond the listed vulnerable releases and confirm sandbox policies prevent loading of untrusted code; retest client deployments with known trigger content.

Typical attack path

Attacker hosts malicious content on a network-accessible resource
Victim user interacts with a sandboxed Java Web Start or applet that loads the untrusted content
JGSS component processes the content via multiple protocols
Data disclosure occurs, sending critical information to the attacker

How to detect it

Review Java client logs for unexpected network connections or data access events originating from sandboxed applications; correlate with user interaction timestamps on systems that execute untrusted code.

What your security team should do

Prioritize patching client-side Java deployments within standard change windows given the five-day publication age and stable low EPSS
Review and tighten Java sandbox policies for any Web Start or applet usage
Monitor vendor advisory updates for exact fixed versions once published

The record

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).

Affected packages

Ecosystem	Package	Introduced	Fixed