CVE-2026-91487: 
Amazon Corretto JDK 脆弱性分析と緩和策

CVE-2026-91487 is a vulnerability in the Compiler component of Oracle Java SE, internally tracked as "Enhance C2 comparisons" (referring to the C2 JIT compiler). It affects Oracle Java SE versions 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27; Oracle GraalVM for JDK versions 17.0.20.1 and 21.0.12.1; and Oracle GraalVM Enterprise Edition 21.3.19.1.1. The vulnerability was disclosed on October 20, 2026, as part of Oracle's Critical Patch Update (CPU) for October 2026. It carries a CVSS v3.1 base score of 4.8 (Medium) (Oracle CPU Oct 2026, Red Hat Bugzilla).

The vulnerability is classified under CWE-1025 (Comparison Using Wrong Factors) and CWE-284 (Improper Access Control), and is associated with improper comparison logic within the C2 JIT compiler component of the JVM. An unauthenticated attacker with network access can exploit this flaw by supplying malicious data to Compiler APIs via multiple protocols (e.g., through a web service), without relying on Untrusted Java Web Start applications or Untrusted Java applets. The high attack complexity (AC:H) rating indicates that exploitation requires specific conditions to be met, making it difficult but not impossible to exploit. No public proof-of-concept code has been identified (Oracle CPU Oct 2026, Red Hat Bugzilla).

Successful exploitation can result in unauthorized read access to a subset of Oracle Java SE accessible data (confidentiality impact) and unauthorized update, insert, or delete access to some Oracle Java SE accessible data (integrity impact). There is no availability impact. The scope is limited to data accessible by the Java SE process, and there is no indication of lateral movement potential or full system compromise based on current information (Oracle CPU Oct 2026).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code for CVE-2026-91487. The NVD SSVC assessment confirms exploitation status as "none" and technical impact as "partial." The EPSS score is approximately 0.00177 (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity further reduces the likelihood of opportunistic exploitation (Oracle CPU Oct 2026, Red Hat Bugzilla).

Oracle has released patches for this vulnerability as part of the October 2026 Critical Patch Update. Users should upgrade to fixed versions of Oracle Java SE (beyond the affected versions: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1), and Oracle GraalVM Enterprise Edition (21.3.19.1.1). Red Hat has issued multiple errata (RHSA-2026:88347 through RHSA-2026:90912) addressing this issue across RHEL 8, 9, 10, and various OpenJDK builds. As a temporary measure, restricting network access to systems running affected Java versions and limiting exposure of Java services to untrusted networks can reduce risk (Oracle CPU Oct 2026, Red Hat Bugzilla).

The vulnerability was addressed by Red Hat through multiple security errata released between October 27–31, 2026, covering a broad range of RHEL versions and OpenJDK builds, indicating broad downstream impact across enterprise Linux distributions. Amazon Linux and AlmaLinux also issued advisories addressing this CVE. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vendor advisory coverage (Red Hat Bugzilla).