CVE-2026-91464: 
Amazon Corretto JDK 취약점 분석 및 완화

CVE-2026-91464 is a vulnerability in the JGSS (Java Generic Security Services) component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition, related to improper Kerberos validation. Disclosed as part of Oracle's October 2026 Critical Patch Update, it affects Oracle Java SE versions 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27; Oracle GraalVM for JDK versions 17.0.20.1 and 21.0.12.1; and Oracle GraalVM Enterprise Edition version 21.3.19.1.1. It carries a CVSS v3.1 base score of 5.3 (Medium) (Oracle Advisory, Red Hat Bugzilla).

The vulnerability is classified under CWE-303 (Incorrect Implementation of Authentication Algorithm) and CWE-416 (Use After Free), and is associated with CAPEC-90 (Reflection Attack in Authentication Protocol), indicating a flaw in how Kerberos authentication is validated within the JGSS component. An unauthenticated remote attacker can exploit this over multiple network protocols, but exploitation is rated as difficult (high attack complexity) and requires human interaction from a victim — consistent with client-side attack scenarios such as Java Web Start applications or sandboxed applets loading untrusted code. The vulnerability does not apply to server-side Java deployments that only execute trusted, administrator-installed code (Oracle Advisory, Red Hat Bugzilla).

Successful exploitation results exclusively in a confidentiality impact — an unauthenticated attacker can gain unauthorized access to critical data or complete access to all data accessible by the affected Java SE, GraalVM for JDK, or GraalVM Enterprise Edition instance. There is no integrity or availability impact. The scope is limited to client-side deployments running sandboxed untrusted code; server deployments running only trusted code are not affected (Oracle Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.0028 (0.28%), indicating a low probability of exploitation in the near term. The attack is rated as difficult to exploit due to high attack complexity and the requirement for user interaction (Oracle Advisory).

Oracle has released patches for this vulnerability as part of the October 2026 Critical Patch Update (CPU). Affected users should upgrade to the patched versions provided in the CPU. Red Hat has addressed this issue via RHSA-2026:88347 (RHEL 9/10), RHSA-2026:88352 (RHEL 8 variants), RHSA-2026:88353 (Red Hat Build of OpenJDK 17.0.21), and RHSA-2026:89916 (Red Hat Build of OpenJDK 17.0.20.1). Prioritize patching client-side Java deployments that execute untrusted code (e.g., Java Web Start, applets); server-side deployments running only trusted code are not affected and do not require immediate remediation for this specific vulnerability (Oracle Advisory, Red Hat Bugzilla).

Red Hat tracked and addressed the vulnerability promptly, issuing multiple errata (RHSA-2026:88347, RHSA-2026:88352, RHSA-2026:88353, RHSA-2026:89916) within one week of Oracle's disclosure. The vulnerability was also catalogued by AUSCERT (ASB-2026.0270) and Amazon Linux Security (ALAS2-2026-4039, ALAS2023-2026-3317, ALAS2CORRETTO8-2026-026), reflecting standard downstream patching activity. No notable independent researcher commentary or significant social media discussion has been identified (Red Hat Bugzilla).