CVE-2026-91487: 
Amazon Corretto JDK vulnerability analysis and mitigation

CVE-2026-91487 is a vulnerability in the Compiler component of Oracle Java SE, classified under CWE-1025 (Comparison Using Wrong Factors). It affects Oracle Java SE versions 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27; Oracle GraalVM for JDK versions 17.0.20.1 and 21.0.12.1; and Oracle GraalVM Enterprise Edition 21.3.19.1.1. The vulnerability was disclosed on October 20, 2026, as part of Oracle's October 2026 Critical Patch Update. It carries a CVSS v3.1 base score of 4.8 (Medium) (Oracle Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-1025 (Comparison Using Wrong Factors), indicating a flaw in how the Java C2 JIT compiler performs certain comparisons — internally tracked as "Enhance C2 comparisons" in OpenJDK. The vulnerability is network-accessible via multiple protocols but requires high attack complexity, meaning exploitation is not straightforward and likely requires specific conditions to be met. Exploitation is constrained to scenarios where an attacker can supply data directly to the Compiler APIs — for example, through a web service — without relying on Untrusted Java Web Start applications or applets (Oracle Advisory, Red Hat Bugzilla).

Successful exploitation can result in limited unauthorized read access to a subset of Oracle Java SE accessible data (confidentiality impact) and unauthorized update, insert, or delete access to some Oracle Java SE accessible data (integrity impact). There is no availability impact. The scope is unchanged, meaning the vulnerability does not enable privilege escalation beyond the Java SE process boundary, and lateral movement potential is limited (Oracle Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the disclosure date (Oracle Advisory). The EPSS score is approximately 0.177%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. High attack complexity further reduces the practical exploitability of this vulnerability.

Oracle has released patches for this vulnerability as part of the October 2026 Critical Patch Update (CPU). Affected users should upgrade to the patched versions of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition provided in the CPU. As a temporary measure, Oracle recommends restricting network access to Java applications and APIs where possible, and implementing network segmentation to limit exposure of systems running affected versions. Oracle strongly advises against relying on network blocking as a long-term solution and recommends applying the security patches without delay (Oracle Advisory).

Red Hat has acknowledged the vulnerability and opened a tracking bug (Bug 2556709) in its Bugzilla system, assigning it medium priority and severity, with the Product Security DevOps Team assigned for remediation tracking (Red Hat Bugzilla). No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability at this time.