PatchTheCEVCVE-2026-91403: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac
45
This month
CRITICAL 9.1REMOTE
CVE-2026-91403 is a critical-severity flaw (CVSS 9.1) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple pr
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 9.1 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 68%) |
| CISA exploited list | No |
| Weakness | CWE-284 |
| Published | 2026-10-21 |
| Last modified | 2026-10-23 |
Publisher (CNA): Oracle
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Debian 12 · openjdk-17 · NO FIX YET
Debian 13 · openjdk-21 · NO FIX YET
Debian 13 · openjdk-25 · NO FIX YET
RHEL 10 · java-21-openjdk · NO FIX YET
RHEL 10 · java-25-openjdk · NO FIX YET
RHEL 6 · java-1.8.0-openjdk · DEFERRED
RHEL 7 · java-1.8.0-openjdk · NO FIX YET
RHEL 8 · java-17-openjdk · NO FIX YET
Advisories and coverage
Official advisories
- HKCERT: Oracle Java Security Restriction Bypass Vulnerability 2026-10-22
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.