Oracle Security Alert Advisory – CVE-2026-91403

Security vulnerabilities addressed by this Security Alert affect the products listed below. Please click on the links in the Patch Availability Document column below to access the documentation for patch availability information and installation instructions. | Affected Products and Versions | Patch Availability Document | |---|---| | Oracle GraalVM Enterprise Edition, version 21.3.20 | Java SE | | Oracle GraalVM for JDK, versions 17.0.21, 21.0.13 | Java SE | | Oracle Java SE, versions 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1 | Java SE | Patches released through the Security Alert program are provided only for product versions that are covered under the Premier Support or Extended Support phases of the Lifetime Support Policy. Oracle recommends that customers plan product upgrades to ensure that patches released through the Security Alert program are available for the versions they are currently running. Product releases that are not under Premier Support or Extended Support are not tested for the presence of vulnerabilities addressed by this Security Alert. However, it is likely that earlier versions of affected releases are also affected by these vulnerabilities. As a result, Oracle recommends that customers upgrade to supported versions. Risk matrices list only security vulnerabilities that are newly addressed by the patches associated with this advisory. Risk matrices for previous security patches can be found in previous Critical Patch Update advisories, Critical Security Patch Update advisories and Alerts. An English text version of the risk matrices provided in this document is here. Security vulnerabilities are scored using CVSS version 3.1 (see Oracle CVSS Scoring for an explanation of how Oracle applies CVSS version 3.1). Oracle conducts an analysis of each security vulnerability addressed by a Security Alert. Oracle does not disclose detailed information about this security analysis to customers, but the resulting Risk Matrix and associated documentation provide information about conditions required to exploit the vulnerability and the potential impact of a successful exploit. Oracle provides this information so that customers may conduct their own risk analysis based on the particulars of their product usage. For more information, see Oracle vulnerability disclosure policies. Third party component vulnerabilities that are deemed not exploitable in the context of their inclusion in an Oracle product are listed, with VEX justifications, below the respective Oracle product's risk matrix. The protocol in the risk matrix implies that all of its secure variants are affected as well. For example, if HTTP is listed as an affected protocol, it implies that HTTPS is also affected. The secure variant of a protocol is listed in the risk matrix only if it is the only variant affected. The following people or organizations reported security vulnerabilities addressed by this Security Alert to Oracle: None credited in this Security Alert. | Date | Note | |---|---| | 2026-October-21 | Rev 1. Initial Release. | This Security Alert contains 1 new security patch for Oracle Java SE. This vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here. | CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see Risk Matrix Definitions) | Supported Versions Affected | Notes | |||||||| |---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---| | Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | ||||||| | CVE-2026-91403 | Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition | JSSE | Multiple | Yes | 9.1 | Network | Low | None | None | Un- changed | High | High | None | Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21, 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20 | See Note 1 |