CVE-2026-91403: Critical Oracle Java SE and GraalVM Flaw Enables Remote Attacks

Oracle has issued an out-of-band Security Alert addressing CVE-2026-91403, a critical vulnerability affecting Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. The security issue resides in the Java Secure Socket Extension (JSSE) component and carries a CVSS v3.1 score of 9.1.

The vulnerability is remotely exploitable without authentication. According to Oracle, an attacker with network access through multiple protocols can compromise vulnerable Java environments without providing credentials or requiring user interaction. Successful exploitation can expose critical data and enable unauthorized modification, creation, or deletion of information accessible to the affected Java runtime.

Rapid7 classifies the flaw as critical and confirms the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. This means exploitation can occur over the network with low attack complexity, requires no privileges or victim interaction, and can have high confidentiality and integrity impact.

The broad deployment of Java across enterprise web services, backend applications, middleware, APIs, and business-critical infrastructure increases the potential exposure. Organizations should therefore identify affected Java and GraalVM runtimes and prioritize Oracle’s Security Alert patches.

Security teams looking for CVE-2026-91403 detection opportunities should monitor Java services for anomalous network interactions, unexpected certificate or TLS-related failures, suspicious child processes, and unusual access to sensitive application data.

SOC Prime’s AI-Native Detection Intelligence Platform can help security teams strengthen their defenses against emerging vulnerability exploitation with detection content mapped to MITRE ATT&CK® and available across multiple SIEM, EDR, and Data Lake environments.

Click Explore Detections to access relevant SOC content and hunting logic. To Detect CVE-2026-91403 and associated post-exploitation behavior, defenders should combine Java application telemetry, network monitoring, endpoint visibility, and service-level logs.

Security teams can also leverage Prime Architect to transform emerging vulnerability intelligence into Sigma rules, generate hunting queries, validate detection logic, and translate detections across supported security platforms.

Contact Sales

CVE-2026-91403 analysis

CVE-2026-91403 impacts the JSSE component used by Java applications to provide secure communications capabilities. Oracle describes the flaw as easily exploitable and confirms that attacks can originate remotely over multiple protocols without authentication.

The vendor has not publicly disclosed the underlying programming error or complete exploitation sequence. Oracle’s vulnerability disclosure policy intentionally limits technical details that could facilitate weaponization while customers deploy patches. Therefore, claims about a specific malformed packet, certificate structure, API argument, or exploitation primitive should not be treated as confirmed unless Oracle publishes additional technical information.

CVE-2026-91403 affects the following supported Oracle releases:

• Oracle Java SE 8u511 and 8u511-perf
• Oracle Java SE 11.0.33
• Oracle Java SE 17.0.21
• Oracle Java SE 21.0.13
• Oracle Java SE 25.0.5
• Oracle Java SE 27.0.1
• Oracle GraalVM for JDK 17.0.21
• Oracle GraalVM for JDK 21.0.13
• Oracle GraalVM Enterprise Edition 21.3.20

Oracle also cautions that unsupported earlier releases were not tested but are likely to contain vulnerabilities addressed by the Security Alert. Organizations still operating unsupported Java branches should therefore not assume they are unaffected.

The attack surface is broader than standalone Java desktop applications. Oracle specifically notes that exploitation can occur through APIs exposed by the vulnerable component, including situations in which a web service passes attacker-controlled data to those APIs.

The vendor also states that the issue applies to Java deployments that execute untrusted code while relying on the Java sandbox for protection, including sandboxed Java Web Start applications and Java applets.

The details for CVE-2026-91403 show particularly serious confidentiality and integrity consequences. Oracle rates both impacts as High while assigning no direct availability impact. A successful attacker could potentially gain unauthorized access to critical application data or modify, create, and delete information available to the compromised Java environment.

That distinction is important for incident response. Organizations should not focus exclusively on service disruption. A vulnerable server may continue operating normally while sensitive information is accessed or application data is modified.

At the time of publication, neither Rapid7 nor Oracle provides a public CVE-2026-91403 PoC or sufficient technical exploitation instructions to independently reproduce the vulnerability. Rapid7 also lists the issue as absent from the CISA Known Exploited Vulnerabilities catalog as of October 22, 2026.

Likewise, no campaign-specific CVE-2026-91403 IOCs such as malicious IP addresses, domains, hashes, or payload signatures have been published in the primary sources. This limits the effectiveness of purely indicator-based hunting and makes behavioral visibility more important.

Security teams should monitor Java-facing services for:

• Unexpected network requests reaching Java applications or web services
• Abnormal TLS or JSSE-related errors
• Changes to application data without corresponding legitimate activity
• Unexpected authentication or authorization anomalies
• Java processes initiating unusual outbound connections
• Unrecognized child processes launched by Java applications
• Modifications to files, configuration, or application resources
• Suspicious API requests immediately preceding abnormal data access

Because the complete exploitation mechanics remain undisclosed, these behaviors cannot prove exploitation on their own. They should instead serve as investigation pivots when combined with vulnerability exposure and application-specific telemetry.

CVE-2026-91403 mitigation

Oracle released a dedicated Security Alert on October 21, 2026 rather than waiting for a later scheduled security cycle. Administrators should apply the patches referenced in Oracle’s patch availability documentation as quickly as operationally possible.

Organizations should first inventory all Java installations, including runtimes bundled with commercial software, middleware products, application servers, containers, development environments, and third-party appliances. Java components embedded inside another product are often overlooked during vulnerability management because administrators may not realize that a separate JDK or JRE exists within the application directory.

Priority should be given to systems that:

• Accept network connections from untrusted sources
• Expose Java-backed web services or APIs
• Process attacker-controlled input
• Handle sensitive business or customer data
• Run unsupported Java releases
• Use Java Web Start or other sandbox-dependent deployment models

Oracle provides Security Alert patches only for versions covered under Premier Support or Extended Support. Earlier releases are not necessarily safe simply because they are absent from the affected-version table. Oracle explicitly recommends moving unsupported deployments to supported versions because older releases may also contain the vulnerability.

If immediate patching is not possible, organizations should reduce exposure by restricting network access to affected services, limiting communication to trusted systems, and applying application-level access controls where feasible. These steps should be treated as temporary risk-reduction measures rather than replacements for the vendor update.

Security teams should also review application and network logs retrospectively. Look for unexpected access to sensitive data, suspicious modifications, anomalous Java network activity, and unusual API requests that cannot be explained by legitimate business operations.

If suspicious behavior is identified, responders should:

• Isolate the affected host where operationally possible.
• Preserve Java application, web-server, endpoint, and network logs.
• Review the integrity of sensitive application data.
• Identify credentials, secrets, and tokens accessible to the Java process.
• Rotate potentially exposed credentials.
• Search for unauthorized changes to application files and configuration.
• Examine outbound connections for signs of follow-on activity.
• Validate other Java systems with the same application configuration.

Because confidentiality and integrity are the primary impacts identified by Oracle, incident response should include data-access and data-modification reviews even when there is no evidence of downtime.

Organizations using SOC Prime’s AI-Native Detection Intelligence Platform can strengthen behavioral monitoring around vulnerable Java services while patches are rolled out and continue hunting for post-compromise activity across their security stack.

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If relevant detections are not yet available, check again as new threat intelligence and detection content are continuously added.