CVE-2026-91463: 
Amazon Corretto JDK vulnerability analysis and mitigation

CVE-2026-91463 is a vulnerability in the JGSS (Java Generic Security Services) component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition, disclosed as part of Oracle's October 2026 Critical Patch Update. It affects Oracle Java SE versions 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27; Oracle GraalVM for JDK versions 17.0.20.1 and 21.0.12.1; and Oracle GraalVM Enterprise Edition version 21.3.19.1.1. The vulnerability allows an unauthenticated network attacker to gain unauthorized read access to sensitive data, but requires human interaction and is rated difficult to exploit. It carries a CVSS v3.1 base score of 5.3 (Medium) (Oracle Advisory).

The vulnerability resides in the JGSS (Java Generic Security Services) component and is classified as a memory disclosure issue. It is exploitable over the network via multiple protocols without requiring authentication, but demands user interaction — consistent with social engineering scenarios where a victim runs untrusted Java code (e.g., via sandboxed Java Web Start applications or Java applets). The attack complexity is rated High, indicating specific conditions must be met. Importantly, this vulnerability does not affect server-side Java deployments that execute only trusted, administrator-installed code; it is scoped to client-side environments loading untrusted code from the internet (Oracle Advisory).

Successful exploitation results exclusively in a confidentiality impact — an attacker can gain unauthorized access to critical data or complete access to all data accessible within the affected Java SE, GraalVM for JDK, or GraalVM Enterprise Edition deployment. There is no integrity or availability impact. The scope is limited to client-side Java environments running sandboxed untrusted code, reducing the breadth of affected assets in typical enterprise server deployments (Oracle Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is rated difficult due to the High attack complexity and the requirement for user interaction, limiting opportunistic exploitation (Oracle Advisory).

1. Reconnaissance: Identify targets running vulnerable client-side Java versions (Oracle Java SE 8u503 through 27, GraalVM for JDK 17.0.20.1/21.0.12.1, or GraalVM Enterprise Edition 21.3.19.1.1) that use Java Web Start or browser-based Java applets to load untrusted code.
2. Craft malicious Java content: Develop a malicious Java Web Start application or applet that exploits the JGSS component flaw to trigger memory disclosure when executed in the sandboxed environment.
3. Social engineering: Lure the target user into launching the malicious Java application — for example, via a phishing email, malicious website, or crafted JNLP file — satisfying the required human interaction condition.
4. Trigger the vulnerability: When the victim executes the untrusted Java code, the JGSS component processes attacker-controlled input in a way that leaks sensitive memory contents accessible within the Java deployment.
5. Exfiltrate data: The disclosed data (potentially including credentials, session tokens, or other sensitive information accessible to the Java process) is transmitted back to the attacker via a network channel.

Oracle has released patches for this vulnerability as part of the October 2026 Critical Patch Update (CPU). Organizations should apply the CPU patches immediately for all affected products: Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1), and Oracle GraalVM Enterprise Edition (21.3.19.1.1). As a workaround, organizations should restrict or disable Java Web Start and browser-based Java applet execution, and educate users not to run untrusted Java applications from the internet. Server deployments running only trusted code are not affected and do not require emergency action (Oracle Advisory).