CVE-2026-91461 Oracle Corporation CVE debrief

Who should care

Defenders and administrators of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition deployments should assess exposure and prioritize remediation, especially for network-accessible TLS interfaces.

Why it matters

CVE-2026-91461 is a low-severity vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. While difficult to exploit, it allows unauthenticated attackers with network access via TLS to potentially modify accessible data. Defenders should assess exposure, prioritize remediation, and implement monitoring and compensating controls as needed.

• Potential unauthorized data modifications
• Need for patching and remediation prioritization
• Importance of monitoring and compensating controls
• Verification of deployment exposure and vulnerability status

Technical summary

The vulnerability affects Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition, specifically in the JSSE component. It allows an unauthenticated attacker with network access via TLS to compromise these products, potentially leading to unauthorized data modifications. The vulnerability is difficult to exploit and requires supplying data to APIs in the specified component without using Untrusted Java Web Start applications or Untrusted Java applets. Successful attacks can result in unauthorized update, insert, or delete access to some accessible data.

Defensive priority

Assess exposure and prioritize remediation for Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition deployments, especially those with network-accessible TLS interfaces.

Recommended defensive actions

• Assess and inventory Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition deployments for exposure
• Prioritize remediation for deployments with network-accessible TLS interfaces
• Verify and apply patches or updates from Oracle
• Monitor for suspicious activity and implement compensating controls if necessary
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its CVSS score, and affected versions. Oracle's security alert page offers additional information. Affected versions include Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Defenders should verify exposure and review vendor guidance for remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.