Oracle Java SE JSSE Flaw CVE-2026-91403 Rated Critical With CVSS 9.1
A critical vulnerability in Oracle Java SE allows unauthenticated network attackers to compromise data integrity and confidentiality via the JSSE component.
Key points
- CVE-2026-91403 affects multiple supported versions of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition.
- The flaw allows unauthenticated attackers with network access to create, delete, or modify critical data.
- Oracle rates the vulnerability as Critical with a CVSS 3.1 Base Score of 9.1.
Oracle has disclosed a critical security vulnerability in its Java SE platform that allows unauthenticated attackers to compromise data integrity and confidentiality. The flaw, identified as CVE-2026-91403, resides in the Java Secure Socket Extension component and affects several supported product lines. According to the National Vulnerability Database record, the issue is easily exploitable over the network.
At a glance
- CVE
- CVE-2026-91403
- Product
- Oracle Java SE
- CVSS
- 9.1 Critical
- Weakness
- —
- Exploited
- No known exploitation
The vulnerability enables an attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. Successful exploitation results in unauthorized creation, deletion, or modification of critical data. Attackers can also gain unauthorized access to all accessible data within these environments. The National Vulnerability Database rates the flaw with a CVSS 3.1 Base Score of 9.1, classifying it as Critical.
Context and Background
The weakness exists within the JSSE component of the Oracle Java SE product family. Attackers can exploit this vulnerability by using APIs in the specified component, such as through a web service that supplies data to those APIs. The National Vulnerability Database notes that the flaw impacts both confidentiality and integrity, with no impact on availability. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
This vulnerability also applies to Java deployments that load and run untrusted code from the internet. Clients running sandboxed Java Web Start applications or sandboxed Java applets rely on the Java sandbox for security. The flaw allows attackers to bypass these protections when such code is executed. This expands the attack surface beyond server-side deployments to client-side environments that process external data.
Who Is Affected
Multiple supported versions of Oracle Java SE are affected
What to do and how to stay safe
- Vulnerability severity scores ignore your specific architecture and context.
- Exploitability depends on network exposure and user behavior, not just code flaws.
- Prioritization requires continuous asset inventory and threat intelligence alignment.
Risk-based vulnerability management focuses your limited resources on the flaws that actually threaten your business. Start by mapping your critical assets and checking for active exploits to prioritize your backlog.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
