---
id: "CVE-2026-91333"
kind: "vulnerability"
aliases: ["CVE-2026-91333"]
title: "Oracle Java SE: flaw lets unauthenticated attacker alter some accessible data"
severity: "low"
cvss: 3.7
epss: 0.00245
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["backend", "java", "oracle-jdk", "runtime", "self-hosted"]
not_affected_if: ["no-java-installed", "no-untrusted-applets"]
published_at: "2026-10-20T22:20:35+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91333", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91333", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle Java SE: flaw lets unauthenticated attacker alter some accessible data

A flaw in the Security component of Oracle Java SE lets an unauthenticated attacker over the network change or delete some data the Java application can reach. The attack is hard to carry out, and the sources report only an integrity impact with a CVSS score of 3.7.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `java -version` and compare against the affected releases 21.0.12.1, 25.0.4.1 and 27.
- Check whether sandboxed Java applets or Java Web Start applications are in use on client machines.

## Fix

- Move Oracle Java SE to a patched release from the Oracle Critical Patch Update for the affected line (21.0.12.1, 25.0.4.1 or 27 and later); the sources do not name the fixed build.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91333
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91333

## From the sources

Vulnerability in Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_