Recommended action window: Monitor and triage in normal cycle
NVD description
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
shut... the ... front... door... was JAVA feeling lonely and wanted to get into the party????? Oracle Security Alert Advisory - CVE-2026-91403 CVS 9.1 https://www.oracle.com/security-alerts/alert-cve-2026-91403.html @uwu_underground
๐จ Oracle publicรณ hoy una alerta de seguridad para Java: CVE-2026-91403, CVSS 9.1. Estรก en JSSE (el TLS de Java) y es explotable por red sin credenciales. Versiones afectadas que lista: Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5 y 27.0.1, y GraalVM. https://oracle.com/security-alerts/alert-cve-2026-91403.html
OracleใJavaๅใ็ทๆฅใขใฉใผใใๅ ฌ้ CVE-2026-91403๏ผCVSS 9.1๏ผ โจJSSEใซใ่ช่จผใชใใงใใใใฏใผใฏใใๆปๆใงใใ่ๅผฑๆงใ ๅฝฑ้ฟไพ:โจใปOracle Java SE 8u511 / 11.0.33 / 17.0.21 / 21.0.13 / 25.0.5 / 27.0.1 ใชใฉโจใปGraalVM for JDKใGraalVM EE ใๅฏพ่ฑก https://www.oracle.com/security-alerts/alert-cve-2026-91403.html
PILNE - Administratorzy dalszy ciฤ g ลatania! Wykryto dwie KRYTYCZNE, niezaลatane luki. Tym razem w Java i NodeJS Obie RCE: CVE-2026-91403 score 9.1/10 i CVE-2026-111497 score HIGH https://t.co/YN5NPcesK6
@ptr_to_joel https://www.oracle.com/security-alerts/alert-cve-2026-91403.html
Que dice #Java que no va a dejar solo a #php โค๏ธโ๐ฅ https://www.oracle.com/security-alerts/alert-cve-2026-91403.html
@niebezpiecznik Tania sensacja, czemu to robicie? "CVE-2026-91403 concerns eight compromised intermediate CA certificates." https://openjdk.org/groups/vulnerability/advisories/2026-10-21
@hazqdanial @rebane2001 And a Java one (CVE-2026-91403 - CVSS 9.1), and a GitLab one (CVE-2026-110264 - CVSS 10.0) https://t.co/EXM5dIFRaB
๐ข Jedziemy dalej... CVE-2026-91403 CVE-2026-111497 https://t.co/NnJrXNAlls
JAVA made sure it didnt miss out on all the fun.. Critical Java Vulnerability: CVE-2026-91403 (CVSS 9.1) https://securedsite.org/t/13-critical-java-vulnerability-cve-2026-91403
not java.. my beloved.. https://www.oracle.com/security-alerts/alert-cve-2026-91403.html
Looks like it's patch time for Java as well :( https://www.cve.org/CVERecord?id=CVE-2026-91403 GraalVM is mentioned, but I wonder if native images are affected ๐ค
Some more joys, this time Java: https://blogs.oracle.com/security/security-alert-cve-2026-91403-released Given this looks to be an out of band release, points to this likely being a critical vulnerability. Oracleโs website has limited details. However other sites point to this being an easy to exploit vulnerability: https://radar.offseq.com/threat/cve-2026-91403-easily-exploitable-vulnerability-allows-unauthenticated-attacker-with-network-access-1a41acad8a5e16af
It's not over.. It's now also Oracle. https://www.oracle.com/security-alerts/alert-cve-2026-91403.html
Oracle's latest alert is a Java flaw exploitable over the network with no credentials needed. Same pattern as the Node and GitLab issues this month. If you're self hosting anything, patch it now. https://www.oracle.com/security-alerts/alert-cve-2026-91403.html
Java ใฎ CVE-2026-91403 ใฎไปถใ ca-certificates ใ ใใขใใใใผใใใใฐใใใฎใใช๏ผ ใใกใใJavaใใจใขใใใใผใใใๆนใใใใฎใฏๅใใใใ ใใฉใใใ
Btw: java got a new patch too https://www.oracle.com/security-alerts/alert-cve-2026-91403.html
@shakedko ื'ืืื... ืื ืืื ืื? ืืืงืจ ืืื! https://blogs.oracle.com/security/security-alert-cve-2026-91403-released
It's National Cybersecurity Awareness Month, and look at what happened in just ONE day: > PHP โ 2 CVEs > Node.js โ 10 CVEs > NGINX โ 5 CVEs > Go โ 1 CVE > GitLab โ 12 CVEs > eMudhra โ CA certificate compromise > Railway โ Secrets potentially exposed >Javaโ CVE-2026-91403 #CVE M
๐จ ๐ฆ๐ฒ๐ฐ๐๐ฟ๐ถ๐๐ ๐๐๐น๐ป๐ฒ๐ฟ๐ฎ๐ฏ๐ถ๐น๐ถ๐๐ถ๐ฒ๐ & ๐ถ๐ป๐ฐ๐ถ๐ฑ๐ฒ๐ป๐๐ (๐ฎ๐ฌโ๐ฎ๐ฎ ๐ข๐ฐ๐ ๐ฎ๐ฌ๐ฎ๐ฒ): ๐ ๐ถ๐ฐ๐ฟ๐ผ๐๐ผ๐ณ๐ 1,400+ CVEs including actively exploited flaws. ๐ข๐ฟ๐ฎ๐ฐ๐น๐ฒ ๐๐ฎ๐๐ฎ CVE-2026-91403 CVSS 9.1 JSSE update needed. ๐ฃ๐๐ฃ (๐ฃ๐๐ฃ๐ฎ๐ฆ๐ต๐ฒ๐น๐น) Unauthenticated RCE, patches available, exploits seen. ๐๐ถ๐๐๐ฎ๐ฏ CVSS 10 unauthenticated RCE, patch immediately. ๐ก๐ผ๐ฑ๐ฒ.๐ท๐ 10 CVEs including Brotli decoder RCE fixed. ๐๐ถ๐๐ฐ๐ผ ๐๐ ๐ฝ๐ฟ๐ฒ๐๐๐๐ฎ๐ CVSS 9.8 unauthenticated root RCE fixed. ๐๐ฝ๐ฎ๐ฐ๐ต๐ฒ ๐ง๐ฟ๐ฎ๐ณ๐ณ๐ถ๐ฐ ๐ฆ๐ฒ๐ฟ๐๐ฒ๐ฟ Multiple CVSS 10 vulnerabilities disclosed. ๐ฃ๐น๐ฒ๐ Four CVEs chain to unauthenticated RCE exploited. ๐ฒ๐ ๐๐ฑ๐ต๐ฟ๐ฎ Eight intermediate CA keys trivially recoverable. ๐ฃ๐๐๐ต๐ผ๐ป-๐ฃ๐ถ๐น๐น๐ผ๐ CVE-2026-96639 CVSS 9.8 imaging library flaw. ๐๐ถ๐๐ฒ๐๐๐ Malicious package stole credentials, rotate secrets. ๐ฅ๐ฎ๐ถ๐น๐๐ฎ๐ Environment variables exposed, rotate all secrets. ๐ก๐๐๐ก๐ซ Five CVEs fixed including critical memory issues. ๐๐ผ Blocked compromised eMudhra intermediates in crypto. ๐ฆ๐ถ๐๐ฒ๐๐๐ฎ๐ฟ๐ฑ OS command injection added to CISA KEV. ๐ฆ๐ถ๐ฒ๐บ๐ฒ๐ป๐ Uncontrolled search path exploited, update now. ๐จ๐ป๐ฏ๐ผ๐๐ป๐ฑ DoQ use-after-free crash fixed in 1.26.2. ๐ฆ๐ถ๐ด๐ป๐ฎ๐น Call can keep receiving audio after hang-up.