CVE-2026-91464: 
Amazon Corretto JDK 脆弱性分析と緩和策

CVE-2026-91464 is a vulnerability in the JGSS (Java Generic Security Services) component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition, related to improper Kerberos validation. Disclosed as part of Oracle's October 2026 Critical Patch Update (released October 20, 2026), it affects Oracle Java SE versions 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27; Oracle GraalVM for JDK versions 17.0.20.1 and 21.0.12.1; and Oracle GraalVM Enterprise Edition version 21.3.19.1.1. It carries a CVSS v3.1 base score of 5.3 (Medium) (Oracle Advisory, Red Hat Bugzilla).

The vulnerability is classified under CWE-303 (Incorrect Implementation of Authentication Algorithm) and CWE-416 (Use After Free), and is associated with CAPEC-90 (Reflection Attack in Authentication Protocol), indicating a flaw in how the JGSS/Kerberos authentication mechanism is implemented within the Java runtime (Red Hat Bugzilla). An unauthenticated remote attacker can exploit this vulnerability over multiple network protocols, but exploitation requires human interaction from a victim user — for example, a user running a sandboxed Java Web Start application or Java applet that loads untrusted code from the internet. The vulnerability specifically does not apply to server-side Java deployments that only execute trusted, administrator-installed code (Oracle Advisory). The attack complexity is rated High, reflecting the difficulty of reliably triggering the flaw.

Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible to the affected Java SE or GraalVM deployment, with a High confidentiality impact and no integrity or availability impact (Oracle Advisory). The scope is limited to client-side Java environments running untrusted code (e.g., sandboxed applets or Java Web Start), meaning server deployments are not at risk. Data exposure is the primary concern, with no lateral movement or availability disruption expected from this vulnerability alone.

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Oracle Advisory). The EPSS score is approximately 0.0028 (0.28%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is rated as non-automatable due to the required human interaction and high attack complexity.

Oracle has released patches as part of the October 2026 Critical Patch Update; users should update to the next available patched release beyond the affected versions listed (8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27 for Java SE; 17.0.20.1 and 21.0.12.1 for GraalVM for JDK; 21.3.19.1.1 for GraalVM Enterprise Edition) (Oracle Advisory). Red Hat has issued multiple errata (RHSA-2026:88347 through RHSA-2026:90912) addressing this CVE across Red Hat Enterprise Linux 8, 9, 10, and various Red Hat Build of OpenJDK versions (Red Hat Bugzilla). Amazon Linux 2, Amazon Linux 2023, AlmaLinux, and openSUSE have also released advisories. As a workaround, organizations should avoid deploying sandboxed Java Web Start applications or Java applets that load untrusted code from the internet, and prioritize patching client-side Java environments over server deployments running only trusted code.

The vulnerability was addressed broadly across the Linux ecosystem, with Red Hat, Amazon Linux, AlmaLinux, openSUSE, and Mageia all issuing advisories and patches within days of Oracle's disclosure (Red Hat Bugzilla). No notable independent researcher commentary or significant social media discussion has been identified for this specific CVE, consistent with its medium severity rating and lack of public exploit code.