CVE-2026-91334 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition systems should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify the inventory of affected systems, assess exposure, and apply patches or mitigations as recommended by Oracle.

Why it matters

Defenders should care about CVE-2026-91334 because it allows unauthorized read access to sensitive data in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. Although the CVSS score is low, defenders should still assess exposure and prioritize remediation to prevent potential data breaches.

• Verify inventory of affected systems
• Assess exposure to the vulnerability
• Prioritize patching or mitigation
• Monitor for potential data breaches

Technical summary

The vulnerability affects Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. It allows an unauthenticated attacker with network access to compromise these products and gain unauthorized read access to a subset of accessible data. The CVSS score is 3.7, indicating a low severity. Defenders should assess exposure, prioritize remediation, and verify the effectiveness of compensating controls. The vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and

Defensive priority

Defenders should prioritize verifying the inventory of affected systems, assessing exposure, and applying patches or mitigations as recommended by Oracle.

Recommended defensive actions

• Verify the inventory of affected Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition systems
• Assess exposure to the vulnerability
• Apply patches or mitigations as recommended by Oracle
• Monitor for potential unauthorized read access to sensitive data
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish definitive exploitation or impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.