CVE-2026-91477

The record

Vulnerability in the Oracle JavaFX product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle JavaFX: 25.0.4 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle JavaFX. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle JavaFX accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).

Affected packages

Related vulnerabilities

• CVE-2026-61728 SOCFortress CoPilot focuses on providing a single pane of glass for all your security… CWE-922
• CVE-2026-118568 Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync… CWE-922
• CVE-2026-118551 Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial… CWE-922
• CVE-2026-109822 Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with… CWE-922
• CVE-2026-87951 Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service… CWE-922
• CVE-2026-44629 Improper access control to the Synergis Softwire installation folder. CWE-922
• CVE-2026-20705 Insecure storage of sensitive information in the Intel(R) TDX module for some Intel(R)… CWE-922
• CVE-2026-47362 In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed… CWE-922