Oracle Releases Emergency Alert for Severe Java and GraalVM Vulnerability
Oracle published an out-of-band security alert for a critical issue tracked as CVE-2026-91403 affecting Java SE and GraalVM products. The flaw is located in the Java Secure Socket Extension component and has a CVSS v3.1 score of 9.1. It can be exploited remotely without authentication.
Oracle’s emergency notice covers CVE-2026-91403, a critical flaw in the Java Secure Socket Extension within Java SE, GraalVM for JDK, and GraalVM Enterprise Edition. The CVSS v3.1 score is 9.1, and Rapid7 rates it critical using a vector showing network access, low complexity, no privileges, and no user interaction.
Because exploitation needs only network reachability and no credentials, affected runtimes could expose data or permit unauthorized changes, additions, or deletions. Java’s broad presence in web services, middleware, APIs, backend systems, and operations-critical infrastructure raises exposure, so organizations should locate vulnerable installations.
The flaw may affect organizations running Java-based web services, APIs, middleware, and backend systems, potentially including services the public relies on. If exploited, data confidentiality and integrity could be at risk, and remediation may demand urgent patching or mitigation. Because Java is widely deployed, disruption could extend beyond individual firms to customers and partners, though actual societal impact depends on exposure and response.