CVE-2026-91487

What it actually does

Improper input validation in the Java compiler component allows an unauthenticated remote attacker to supply crafted data via network-accessible APIs, resulting in unauthorized modification or insertion/deletion of a subset of accessible data along with read access to another subset.

Why it matters to the business

Organizations running the affected Java versions face a low-likelihood risk of limited data tampering or leakage through exposed compiler APIs; the flaw's high attack complexity and lack of known exploitation reduce immediate operational disruption but still require attention given Java's broad deployment.

How an attack unfolds

An attacker with network reachability identifies exposed Java compiler APIs, crafts and sends malicious input payloads over supported protocols, and triggers the validation flaw to achieve partial unauthorized data changes and reads without needing authentication or user interaction.

How to fix it

Apply the latest vendor security updates for Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition as they become available; restrict network exposure of compiler-related APIs and enforce least-privilege access controls where possible.

How to confirm the fix worked

Verify that all running Java installations report versions beyond the affected releases listed by Oracle, confirm compiler API endpoints are no longer reachable from untrusted networks, and re-test any custom code paths that supply data to the compiler component.

Typical attack path

1. Locate network-accessible endpoints or services exposing Java compiler APIs
2. Craft and transmit specially formed input data over one of the supported protocols
3. Trigger the improper validation path inside the compiler component
4. Obtain unauthorized read access and limited update/insert/delete capabilities on affected data

How to detect it

Examine network logs and application traces for unexpected or malformed inputs directed at compiler APIs; review Java process activity and data-access audit logs for anomalous modification or read patterns originating from unauthenticated remote sources.

What your security team should do

• Inventory all Java SE and GraalVM deployments and prioritize patching within standard maintenance windows given the low EPSS and absence from KEV
• Review and restrict network accessibility of any services exposing compiler APIs
• Monitor vendor advisories for the release of fixed versions and schedule upgrades accordingly