CVE-2026-91477 Oracle Corporation CVE debrief

Who should care

Defenders responsible for JavaFX deployments, especially those loading and running untrusted code, should assess exposure and prioritize patching or mitigation efforts. This includes verifying JavaFX deployments for potential exposure, applying patches or mitigations as available, and monitoring deployments for suspicious activity. Defenders should also review compensating controls for exposed systems and track exceptions and retest remediated assets.

Why it matters

Defenders should care about CVE-2026-91477 because it affects Oracle JavaFX, potentially allowing unauthorized data access. Verification of deployments, especially those loading untrusted code, and patching or mitigation efforts are necessary.

• Verification of JavaFX deployments for potential exposure.
• Potential unauthorized read access to a subset of Oracle JavaFX accessible data.
• Need for human interaction from a person other than the attacker for successful attacks.
• Low severity impact as per CVSS 3.1 Base Score of 3.1.

Technical summary

The vulnerability in Oracle JavaFX (CVE-2026-91477) allows an unauthenticated attacker with network access to potentially compromise the product and gain unauthorized read access to a subset of accessible data. This issue affects Oracle JavaFX versions 25.0.4 and 27. The vulnerability requires human interaction from a person other than the attacker and has a CVSS 3.1 Base Score of 3.1, indicating a low severity.

Defensive priority

Defenders should prioritize verifying JavaFX deployments, especially those loading and running untrusted code, and apply patches or mitigations as available.

Recommended defensive actions

• Verify JavaFX deployments for potential exposure, especially those loading and running untrusted code.
• Apply patches or mitigations as available from Oracle.
• Monitor JavaFX deployments for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and affected versions. Oracle's security alert also provides relevant information. Defenders should verify JavaFX deployments, especially those loading untrusted code, and apply patches or mitigations as available. The vulnerability affects Oracle JavaFX versions 25.0.4 and 27, and it requires human interaction from a person other than the attacker. Successful attacks can result in unauthorized read access to a subset of Oracle JavaFX accessible data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.