CVE-2026-91403: 
Amazon Corretto JDK vulnerability analysis and mitigation

CVE-2026-91403 is a critical vulnerability in the JSSE (Java Secure Socket Extension) component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition, allowing unauthenticated network attackers to compromise confidentiality and integrity of accessible data. Affected versions include Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; and Oracle GraalVM Enterprise Edition: 21.3.20. The vulnerability was published on October 21, 2026, with a patch made available the same day. It carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, Oracle Advisory).

The vulnerability resides in the JSSE component of Oracle Java SE and GraalVM products, which handles SSL/TLS communications. No CWE classification has been formally assigned at this time. The flaw is exploitable via multiple network protocols by unauthenticated attackers — either through direct API usage in the JSSE component, via web services that supply data to those APIs, or through sandboxed Java Web Start applications and Java applets that load untrusted code from the internet. No preconditions such as authentication or user interaction are required, making this an easily exploitable, zero-click network vulnerability (GitHub Advisory, Oracle Advisory).

Successful exploitation allows an unauthenticated remote attacker to achieve unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all data accessible by the affected Java runtime. Both confidentiality and integrity are fully compromised, while availability is not directly impacted. The broad deployment of Java SE across enterprise environments — including servers, client applications, and sandboxed applets — significantly amplifies the potential blast radius, with risk of data exfiltration and data tampering across any system running a vulnerable Java version (GitHub Advisory, Oracle Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability is rated "easily exploitable" by Oracle, requiring no authentication, no privileges, and no user interaction over the network. No EPSS score or CISA KEV catalog entry has been reported for this CVE at this time. The vulnerability is trending in threat intelligence feeds, indicating elevated community attention shortly after disclosure (Oracle Advisory).

Oracle has released patches addressing this vulnerability; administrators should apply the latest Oracle Critical Patch Update for all affected products. Specifically, upgrade Oracle Java SE from affected versions (8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1), Oracle GraalVM for JDK (17.0.21, 21.0.13), and Oracle GraalVM Enterprise Edition (21.3.20) to their respective patched releases. As an interim measure, restrict network access to systems running affected Java versions, and disable or sandbox Java Web Start applications and Java applets that load untrusted code from the internet (Oracle Advisory, GitHub Advisory).

Oracle published a dedicated security alert page for CVE-2026-91403 shortly after disclosure, and the vulnerability was discussed on Hacker News and across social platforms including Bluesky (Oracle Advisory). Security organizations including AUSCERT and HKCERT issued bulletins advising their constituencies to apply patches promptly (AUSCERT Bulletin, HKCERT Bulletin). Community sentiment reflects concern given the critical CVSS score and the ubiquity of Java deployments, though the absence of a public PoC has tempered immediate alarm.