Oracle has issued a security advisory regarding a critical vulnerability, identified as CVE-2026-91403, which affects several of its software products. The flaw carries a CVSS 3.1 score of 9.1 and allows unauthorized attackers to execute remote attacks.
The vulnerability resides in the Java Secure Socket Extension (JSSE) component. According to the company, the exploit requires low complexity and does not necessitate user interaction or authentication. Successful exploitation could compromise system confidentiality and integrity.
The issue impacts Oracle Java SE versions 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1. Additionally, it affects Oracle GraalVM for JDK versions 17.0.21 and 21.0.13, as well as Oracle GraalVM Enterprise Edition 21.3.20.
Attackers may leverage the vulnerability by calling specific component APIs, such as those used in web services. The flaw also poses risks to client-side Java applications that rely on the Java sandbox for security, including Java Web Start and applets.
Oracle has released security patches for products under premium and extended support plans. The company urges users to update their software installations immediately to mitigate the identified security risks.
