Oracle Java SE and GraalVM: JSSE Security Vulnerability (CVE-2026-91403)
A critical vulnerability in the Java Secure Socket Extension (JSSE) component allows unauthenticated remote attackers to access, modify, create, or delete sensitive data within affected Oracle Java SE and GraalVM environments.
CVE search metadata
CVE search record: CVE-2026-91403. Severity: critical. CVSS: 9.1. KEV: no. Product: Java SE, GraalVM for JDK, GraalVM Enterprise Edition. Brief: Oracle Java SE and GraalVM: JSSE Security Vulnerability (CVE-2026-91403). Brief link: https://feed.craftedsignal.io/briefs/2026-10-oracle-jsse-rce/
Triage facts
Revision 1- Applicability
- Java SE, GraalVM for JDK +1
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Oct 22, 13:48 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B2Likely
Oracle has issued an out-of-band Security Alert for CVE-2026-91403, a critical vulnerability (CVSS 9.1) affecting the Java Secure Socket Extension (JSSE) component in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. The flaw is remotely exploitable without authentication or user interaction. Oracle notes that successful exploitation can expose critical data and allow unauthorized modification, creation, or deletion of information accessible to the affected Java runtime. Oracle has not publicly disclosed the underlying technical exploitation mechanism.
Impact
Successful exploitation impacts the confidentiality and integrity of information accessible to the compromised Java environment. Oracle states there is no direct availability impact.
Recommendation
Oracle advises administrators to identify affected Java and GraalVM runtimes and prioritize the application of provided security patches.
Immediate actions
Identify all instances of vulnerable Java versions in the enterprise environment.
Mitigations
Apply Oracle security patches.
CVE-2026-91403