Cloudanix VulnDB

CVE-2026-91464

Medium · 5.3

CVSS

5.3

EPSS

0.3%

Published

Oct 20, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A recently disclosed weakness in certain Java client software could let an attacker see private data if a user runs an untrusted program inside a protected browser window, though the attack is hard to pull off and no one has used it yet.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
High
Impact
Data Exposure
Component
Library
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A flaw in the JGSS component permits an unauthenticated remote attacker to obtain unauthorized access to sensitive or all accessible data when a client Java deployment loads and executes untrusted code from the network inside a sandbox.

Why it matters to the business

Organizations that rely on Java clients for sandboxed web applications or applets face a low-probability risk of data exposure; the recent publication and absence of known exploitation keep immediate operational disruption minimal.

How an attack unfolds

An attacker crafts a malicious network payload delivered via protocols accepted by JGSS; a victim user must then interact with a sandboxed Java client application that loads the untrusted code, after which the flaw leaks data back to the attacker.

How to fix it

Apply the latest Oracle Critical Patch Update that addresses this issue in Java SE, GraalVM for JDK, and GraalVM Enterprise Edition; disable or restrict sandboxed Java Web Start and applet execution where feasible until patches are installed.

How to confirm the fix worked

Confirm the installed Java runtime reports a version newer than those listed as affected in the October 2026 CPU; re-test client deployments to ensure untrusted code no longer triggers data disclosure under the documented conditions.

Typical attack path

  1. Identify Java client deployments that load untrusted sandboxed code
  2. Prepare a network-delivered payload targeting the JGSS component
  3. Wait for or induce user interaction that causes the client to process the payload
  4. Exfiltrate any data disclosed by the successful trigger of the flaw

How to detect it

Review Java client process logs and network traffic for unexpected JGSS protocol exchanges initiated after loading remote code; correlate with user activity timestamps on endpoints that still run affected Java versions.

What your security team should do

  • Prioritize patching Java client runtimes within the next scheduled maintenance window given the five-day publication age
  • Audit environments for any remaining use of sandboxed Java applets or Web Start applications
  • Update endpoint detection rules to watch for unusual JGSS network activity from client processes
  • Communicate to application owners that server-side trusted code deployments are unaffected

The record

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities