CVE-2026-91464: 
Amazon Corretto JDK vulnerability analysis and mitigation

CVE-2026-91464 is a confidentiality vulnerability in the JGSS (Java Generic Security Services) component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition, disclosed as part of Oracle's October 2026 Critical Patch Update. Affected versions include Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; and Oracle GraalVM Enterprise Edition: 21.3.19.1.1. The vulnerability was published on October 20, 2026, and a patch is available. It carries a CVSS v3.1 base score of 5.3 (Medium) (Oracle Advisory).

The vulnerability resides in the JGSS component of Oracle Java SE and related products, and is classified as a memory disclosure issue. An unauthenticated attacker with network access via multiple protocols can exploit this flaw, but exploitation is rated as difficult (high attack complexity) and requires human interaction from a victim — consistent with client-side attack scenarios such as sandboxed Java Web Start applications or Java applets loading untrusted code. The vulnerability does not apply to server-side Java deployments that execute only trusted, administrator-installed code. No specific CWE classification or public technical write-up has been disclosed beyond Oracle's advisory (Oracle Advisory).

Successful exploitation results in unauthorized read access to critical data accessible by the affected Java runtime — confidentiality impact is rated High, while integrity and availability are unaffected. The attack scope is limited to client-side environments running sandboxed untrusted code (e.g., Java Web Start or applets), and server deployments running only trusted code are explicitly not at risk. There is no evidence of lateral movement capability or availability disruption associated with this vulnerability (Oracle Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Detection support is available via Qualys scanner (detection ID 389096) (Oracle Advisory).

Oracle has released patches for all affected versions as part of the October 2026 Critical Patch Update (CPU). Organizations should apply the relevant Java SE or GraalVM patches immediately, prioritizing client-side deployments that execute untrusted code such as Java Web Start applications or applets. Server-side deployments running only trusted, administrator-installed code are not affected and do not require emergency patching for this specific vulnerability. Oracle strongly recommends applying CPU patches as soon as possible rather than relying on network-level workarounds (Oracle Advisory).