Oracle Java SE and GraalVM JSSE flaw lets unauthenticated attackers read and modify data (CVE-2026-91403)

What happened

The vulnerability is in the JSSE component of Oracle Java SE and GraalVM. According to the CVSS vector, an unauthenticated attacker can exploit it over a network with low complexity, requiring no privileges and no user interaction. Successful attacks can create, delete or modify critical data, and give unauthorized read access to critical or complete data. Availability is not affected. The flaw can be triggered through APIs in JSSE, for example through a web service that supplies data to those APIs.

Oracle rates the issue Critical with a CVSS 3.1 base score of 9.1. The CVE record does not list exploitation in the wild or public disclosure.

Who is affected

Oracle lists these exact builds as affected:

• Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1
• Oracle GraalVM for JDK: 17.0.21, 21.0.13
• Oracle GraalVM Enterprise Edition: 21.3.20

The vulnerability also applies to Java deployments that load and run untrusted code, such as sandboxed Java Web Start applications or applets, and can be reached through a web service that supplies data to JSSE APIs.

What to do now

1. Confirm which of the listed Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition builds you run, including any embedded in supplier products or application servers.
2. Apply Oracle's fix for this alert. No specific fixed version numbers are listed on this page; use Oracle Security Alert Advisory CVE-2026-91403 at https://www.oracle.com/security-alerts/alert-cve-2026-91403.html to find the fixed builds for your environment.
3. If patching cannot be done immediately, restrict network access to Java services or web service endpoints that use JSSE until the update is applied.
4. Re-check the alert for sandboxed Java Web Start or Java applet code paths, as those deployments are also affected.

Beyond the patch

Because this flaw is reachable over the network without credentials, an internet-facing Java service is a measurable exposure before anyone attempts exploitation. Virtual CISO Services (vCISO) can help identify and prioritise that exposure. Java runtimes also arrive through supplier products, and their patch cycle is often your exposure window; Supply Chain Defense & Third-Party Risk helps track which Java components you rely on and how quickly suppliers fix them.