How do I check whether I am affected by CVE-2026-91395?

- Run `java -version` and compare against the affected releases: Oracle Java SE 8u503, 8u503-perf, 11.0.32.1; GraalVM for JDK 17.0.20.1 and 21.0.12.1; GraalVM Enterprise Edition 21.3.19.1.1 - Check whether any service that accepts untrusted network input runs on one of those builds

What is the fix for CVE-2026-91395?

- Move Oracle Java SE, GraalVM for JDK or GraalVM Enterprise Edition to a release newer than the affected versions listed above, using the vendor's April 2026 Critical Patch Update build - Unknown exact fixed build numbers: the sources do not name them

Who is not affected by CVE-2026-91395?

Not affected if: no-network-exposed-utility-api, unaffected-jdk-build.

Live › vulnerability › CVE-2026-91395

Go to dashboard

medium6.5Runtime

Oracle Java SE and GraalVM: network attacker can alter data or cause partial denial of service

Oracle Java SE and GraalVM for JDK ship a flaw in the Utility component that an unauthenticated network attacker can reach through APIs, for example via a web service that passes data to them. A successful attack can let the attacker modify or delete some accessible data and partly disrupt the Java process.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

6.5

medium

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 22, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker modifies or deletes some data and partly disrupts Java service.
CVSS said: 6.5. The facts above say high; we keep the sources' medium until an analyst looks.

Who is affected

Applications that run on an affected Oracle Java SE or GraalVM build and expose the vulnerable Utility component to network input, such as a web service that passes request data into those APIs. The sources also mention sandboxed Java applets and Web Start clients that run untrusted code. Teams on other JDK distributions or on unaffected builds can skip it.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-91395

Go to dashboard

medium6.5Runtime

Oracle Java SE and GraalVM: network attacker can alter data or cause partial denial of service

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

6.5

medium

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 22, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker modifies or deletes some data and partly disrupts Java service.
CVSS said: 6.5. The facts above say high; we keep the sources' medium until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

Oracle Java SE and GraalVM: network attacker can alter data or cause partial denial of service

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

Oracle Java SE and GraalVM: network attacker can alter data or cause partial denial of service

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources