CVE-2026-91462: 
Amazon Corretto JDK vulnerability analysis and mitigation

CVE-2026-91462 is a tampering vulnerability in the JGSS (Java Generic Security Services) component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. It was disclosed on October 20, 2026, as part of Oracle's Critical Patch Update (CPU) for October 2026. Affected versions include Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; and Oracle GraalVM Enterprise Edition: 21.3.19.1.1. It carries a CVSS v3.1 base score of 5.9 (Medium) (Oracle Advisory).

The vulnerability resides in the JGSS (Java Generic Security Services) component and can be triggered by supplying malicious data to JGSS APIs — for example, through a web service — without requiring Untrusted Java Web Start applications or Untrusted Java applets. The attack vector is network-based with high attack complexity, requiring no privileges or user interaction, and the scope is unchanged. No specific CWE classification has been publicly assigned, but the nature of the flaw is consistent with improper input validation in a security-sensitive API. Exploitation is considered difficult due to the high attack complexity requirement (Oracle Advisory).

Successful exploitation allows an unauthenticated remote attacker to perform unauthorized creation, deletion, or modification of critical data accessible to the affected Java SE or GraalVM installation. The impact is limited to integrity — there is no confidentiality or availability impact. Because the vulnerability is exploitable via web services, any application exposing JGSS-based functionality over a network could be at risk of data tampering (Oracle Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity requirement further reduces the practical exploitability of this vulnerability (Oracle Advisory).

Oracle has released patches for this vulnerability as part of the October 2026 Critical Patch Update. Administrators should update to the patched versions of Oracle Java SE, Oracle GraalVM for JDK, or Oracle GraalVM Enterprise Edition as soon as possible. As a temporary measure, Oracle recommends blocking network protocols required by the attack at the network perimeter, and restricting access to JGSS-based APIs where feasible, though neither approach is a long-term solution. Oracle strongly advises against using Untrusted Java Web Start applications or Untrusted Java applets as additional risk vectors (Oracle Advisory).