{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/graalvm-for-jdk/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-91403"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Java SE","GraalVM for JDK","GraalVM Enterprise Edition"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Oracle"],"content_html":"\u003cp\u003eOracle has issued an out-of-band Security Alert for CVE-2026-91403, a critical vulnerability (CVSS 9.1) affecting the Java Secure Socket Extension (JSSE) component in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. The flaw is remotely exploitable without authentication or user interaction. Oracle notes that successful exploitation can expose critical data and allow unauthorized modification, creation, or deletion of information accessible to the affected Java runtime. Oracle has not publicly disclosed the underlying technical exploitation mechanism.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation impacts the confidentiality and integrity of information accessible to the compromised Java environment. Oracle states there is no direct availability impact.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eOracle advises administrators to identify affected Java and GraalVM runtimes and prioritize the application of provided security patches.\u003c/p\u003e\n","date_modified":"2026-10-22T13:48:12Z","date_published":"2026-10-22T13:48:12Z","id":"https://feed.craftedsignal.io/briefs/2026-10-oracle-jsse-rce/","summary":"A critical vulnerability in the Java Secure Socket Extension (JSSE) component allows unauthenticated remote attackers to access, modify, create, or delete sensitive data within affected Oracle Java SE and GraalVM environments.","title":"Oracle Java SE and GraalVM: JSSE Security Vulnerability (CVE-2026-91403)","url":"https://feed.craftedsignal.io/briefs/2026-10-oracle-jsse-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - GraalVM for JDK","version":"https://jsonfeed.org/version/1.1"}