Patching Oracle Java and GraalVM Essential to Block Remote JSSE Data Theft via CVE-2026-91403

An attacker with network access can exploit a critical flaw in Oracle Java SE components to gain unauthorized access to all accessible data. The vulnerability requires no authentication, allowing remote compromise through multiple protocols without user interaction or prior credentials.

Successful exploitation results in the creation, deletion, or modification of critical data within the system. The National Vulnerability Database rates CVE-2026-91403 as critical with a CVSS score of 9.1, citing high impacts on both confidentiality and integrity.

Scope of the vulnerability

The issue resides in the Java Secure Socket Extension (JSSE) component of Oracle Java SE. It affects a wide range of supported releases, including Oracle Java SE versions 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1.

Oracle GraalVM for JDK versions 17.0.21 and 21.0.13 are also impacted. Additionally, Oracle GraalVM Enterprise Edition version 21.3.20 contains the same vulnerability. These products are widely used in enterprise environments for secure communications.

Attack vector and impact

The vulnerability is easily exploitable by an unauthenticated attacker with network access. It can be triggered via APIs in the specified component, such as through a web service supplying data to those APIs. This allows remote exploitation without needing local system privileges.

The flaw also applies to Java deployments running sandboxed Java Web Start applications or sandboxed Java applets. These clients often load untrusted code from the internet and rely on the Java sandbox for security, which this flaw bypasses.

What to watch

Organizations should monitor official Oracle security advisories for updates addressing CVE-2026-91403. Until an update is available, restrict network access to systems running affected Java versions to reduce exposure.

Security teams should verify if their environments use the affected JSSE component. Check for any web services or APIs that might supply data to this component, as these are potential attack vectors for remote exploitation.

What made it possible

This incident illustrates how flaws in cryptographic libraries can undermine system security. Attackers often target components handling secure communications because they are network-facing and critical. Teams usually assess exposure by mapping network paths to vulnerable services. Check whether untrusted inputs reach JSSE APIs directly. This stage of an intrusion allows initial access without authentication, bypassing perimeter defenses.

Background: Security advisories

Security advisories provide the technical context needed to prioritize patches. They explain the severity, affected components, and mitigation steps. Without them, teams guess which fixes matter, leaving critical gaps open to exploitation while wasting time on low-risk updates.

Read the full guide: How Security Advisories Drive Patch Decisions and Reduce Risk

What to do and how to stay safe: Oracle Java SE

• Audit all systems running Oracle Java SE or GraalVM to identify affected versions listed in the NVD record.
• Restrict network access to servers and clients running these versions to limit unauthenticated remote exploitation attempts.
• Monitor logs for unusual API activity or data modifications that could indicate exploitation of the JSSE component.
• Prepare to apply updates immediately once Oracle releases a patch for CVE-2026-91403 to mitigate the risk.

Step-by-step guide: Risk-Based Vulnerability Management: How to Prioritize What to Fix First

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Oracle Java versions are affected by CVE-2026-91403?

Affected versions include Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1, GraalVM for JDK 17.0.21, 21.0.13, and GraalVM Enterprise Edition 21.3.20.

Can this vulnerability be exploited remotely without authentication?

Yes, the NVD record states that an unauthenticated attacker with network access can easily exploit this vulnerability via multiple protocols.

What is the CVSS score for this vulnerability?

CVE-2026-91403 has a CVSS 3.1 Base Score of 9.1, which is rated as critical due to high confidentiality and integrity impacts.