CVE-2026-91487: 
Amazon Corretto JDK 취약점 분석 및 완화

CVE-2026-91487 is a vulnerability in the Compiler component (C2 comparisons) of Oracle Java SE that allows an unauthenticated network attacker to perform unauthorized read and write operations on data accessible to the affected Java SE instance. It was disclosed on October 20, 2026, as part of Oracle's October 2026 Critical Patch Update (CPU). Affected versions include Oracle Java SE 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27; Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1; and Oracle GraalVM Enterprise Edition 21.3.19.1.1. The vulnerability carries a CVSS v3.1 base score of 4.8 (Medium) (Oracle CPU Oct 2026, Red Hat Bugzilla).

The vulnerability is rooted in improper comparison logic within the Java C2 JIT compiler, classified under CWE-1025 (Comparison Using Wrong Factors) and CWE-284 (Improper Access Control). An unauthenticated attacker with network access can exploit this flaw by supplying crafted data to the Compiler APIs via multiple network protocols (e.g., HTTP, HTTPS, or other supported protocols). Exploitation is constrained to scenarios where data is supplied directly to the Compiler APIs — it cannot be triggered via Untrusted Java Web Start applications or Untrusted Java applets. The high attack complexity (AC:H) reflects the difficulty in reliably triggering the faulty comparison behavior (Oracle CPU Oct 2026, Red Hat Bugzilla).

Successful exploitation results in limited confidentiality and integrity impacts: an attacker can gain unauthorized read access to a subset of Oracle Java SE accessible data and perform unauthorized update, insert, or delete operations on some accessible data. Availability is not impacted. The scope is unchanged, meaning the vulnerability does not enable privilege escalation beyond the Java SE process boundary, and lateral movement potential is limited given the constrained attack surface (Oracle CPU Oct 2026).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.177%, reflecting a low probability of exploitation in the near term. The high attack complexity further reduces practical exploitability, as attackers must meet specific conditions to trigger the faulty compiler comparison (Oracle CPU Oct 2026, Red Hat Bugzilla).

Oracle has released patches for this vulnerability as part of the October 2026 Critical Patch Update. Users should upgrade to the next available patched release for their Java SE version (e.g., the subsequent quarterly CPU release beyond the affected versions listed). Red Hat has addressed this issue via errata RHSA-2026:88347 (RHEL 9/10), RHSA-2026:88352 (RHEL 8 variants), RHSA-2026:88353 (OpenJDK 17.0.21), and RHSA-2026:89916 (Red Hat Build of OpenJDK 17.0.20.1). As a temporary workaround, Oracle recommends restricting network access to Java applications and APIs where possible, and implementing network segmentation to limit exposure of systems running affected Java SE versions (Oracle CPU Oct 2026, Red Hat Bugzilla).

Red Hat promptly issued multiple security errata addressing CVE-2026-91487 across RHEL 8, RHEL 9, RHEL 10, and Red Hat Build of OpenJDK within one week of Oracle's disclosure, indicating active downstream patching activity. No notable independent researcher commentary or significant social media discussion has been identified for this medium-severity vulnerability (Red Hat Bugzilla).