Oracle Java SE Flaw Puts Sensitive Data at Risk

What happened

Oracle has identified a security flaw affecting Java SE and related GraalVM products, with OpenJDK releases also included in the affected-version list. Think of it as a weakness in the lock protecting a shared filing cabinet: someone reaching it over a network could gain access to records or change their contents without permission. The flaw is tracked as CVE-2026-91403.

The vendor advisory and the National Vulnerability Database, or NVD, describe a problem in JSSE, the Java component used for secure network communications. An attacker does not need to sign in before attempting exploitation. Successful attacks could expose sensitive information or allow unauthorized creation, deletion or modification of data accessible to an affected deployment.

NVD published its entry on 2026-10-21 and assigns the flaw a CRITICAL severity rating. KISA, Korea's Internet & Security Agency, also published an advisory on 2026-10-23. The recommended response is to apply the Oracle security patch or the relevant OpenJDK vendor security update.

Technical details

NVD associates CVE-2026-91403 with CWE-327, Use of a Broken or Risky Cryptographic Algorithm. Cryptography is the technology used to protect information, including information exchanged over a network. This classification identifies a weakness involving cryptographic protection, but the description does not identify the particular algorithm or explain the underlying implementation error.

The affected component is JSSE, short for Java Secure Socket Extension. The description says exploitation can occur through calls to its application programming interfaces, or APIs: the functions software uses to request a component's services. A web service that passes supplied data into those APIs is an example of a route to the vulnerable code. The description does not provide a complete attack sequence or identify a specific network protocol.

The stated attack conditions are network access and no authentication requirement. The potential impact covers both confidentiality, meaning who can read information, and integrity, meaning who can create, change or delete it. Access could extend to critical data or all data available to the affected deployment; the description does not establish access to every resource on the host.

The CVSS score is 9.1 under CVSS version 3.1. CVSS, the Common Vulnerability Scoring System, summarizes a vulnerability's technical severity and attack conditions. Here, the score supports the CRITICAL rating and makes patching a priority. It does not establish whether a particular application exposes the affected APIs or whether an attack has occurred.

Who is affected

Everyday users

Everyday users should check whether software they use relies on an affected Java runtime, the software that runs Java applications. The concern is unauthorized access to information or changes to information available to that application. Having an affected version warrants an update, but the version alone does not establish that someone has accessed your data.

If an application includes its own Java runtime, follow the application vendor's update guidance as well as the relevant security advisory. Updating a separately installed Java copy does not confirm that the application is using the updated runtime.

Developers

Developers should review applications that use JSSE APIs, especially services that pass network-supplied data into them. The advisory's web-service example makes that data flow relevant to exposure assessment. The available description does not support narrowing the problem to a particular framework, endpoint or protocol.

Check the runtime used by deployed applications as well as development environments. Apply the appropriate security update, then test application behavior that depends on secure communications. Because no exact fixed release is named here, use the vendor advisory to identify the correct patched build for your product and release branch.

Server and IT admins

For Java SE, the affected branches are 8u511 and earlier, 8u511-perf and earlier, 11.0.33 and earlier, 17.0.21 and earlier, 21.0.13 and earlier, 25.0.5 and earlier, and 27.0.1 and earlier. GraalVM for JDK is affected at 17.0.21 and earlier and 21.0.13 and earlier. GraalVM Enterprise Edition is affected at 21.3.20 and earlier. Apply the Oracle security patch for these products.

For OpenJDK, the affected branches are 8u504 and earlier, 11.0.32.1 and earlier, 17.0.21 and earlier, 21.0.13 and earlier, 25.0.5 and earlier, and 27.0.1 and earlier. Apply the vendor security update. Match each installation to its own product and release branch, and check the runtime actually used by each service before treating that service as patched.

What to do now

1. Inventory Java SE, GraalVM for JDK, GraalVM Enterprise Edition and OpenJDK installations, including runtimes supplied with applications.
2. Check the Java version and compare it with the affected range for that product and release branch. Confirm which runtime each application or service uses.
3. Read the vendor advisory to identify the applicable security patch or update. The listed affected-version boundaries are not fixed-version recommendations.
4. Apply the Oracle security patch for affected Oracle products or the vendor security update for affected OpenJDK installations. Follow the update steps in the vendor's advisory.
5. Follow the vendor's instructions for putting the updated runtime into use, including any required application or service restart.
6. Confirm the deployed runtime and test relevant application functions, particularly those using secure network communications.

java -version

If you can't update yet

• Check the vendor advisory for guidance on restricting network access to affected services and reducing their internet exposure while an update is pending. Treat access restrictions as an interim measure, not confirmation that the flaw is fixed.

How to confirm the fix

• Compare the installed runtime's version and patch information with the vendor advisory's remediation guidance. Do not assume an affected-version boundary identifies the fixed release.
• Confirm that each application and service is using the updated runtime. A version check in your terminal establishes the runtime selected there, which may differ from the runtime a service uses.
• Check that the update completed successfully and perform functional checks of applications that rely on JSSE.

NVD scores and CISA KEV status

As of October 30, 2026, none of these CVEs is listed in the CISA Known Exploited Vulnerabilities catalog.

Affected products and fixed versions 16 rows

The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.

Frequently asked questions

References

• Oracle advisory: https://www.oracle.com/security-alerts/alert-cve-2026-91403.html
• Oracle advisory: https://openjdk.org/groups/vulnerability/advisories/2026-10-21
• NVD: CVE-2026-91403
• CISA Known Exploited Vulnerabilities catalog
• Also reported by KISA (Korea Internet & Security Agency) on October 23, 2026: KISA advisory (Korean)

How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.