How do I check whether I am affected by CVE-2026-91452?

- Run `java -version` and compare against the affected releases: 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27 - For GraalVM, check `native-image --version` against 17.0.20.1, 21.0.12.1 or 21.3.19.1.1 - Confirm whether a service exposes the Java Networking APIs to untrusted input, such as a web service

What is the fix for CVE-2026-91452?

- Upgrade Oracle Java SE to the patched release from Oracle's April 2026 Critical Patch Update (exact fixed versions unknown from the sources) - Upgrade Oracle GraalVM for JDK and GraalVM Enterprise Edition to the patched release from the same update

Who is not affected by CVE-2026-91452?

Not affected if: no-untrusted-network-input, not-using-affected-version.

Live › vulnerability › CVE-2026-91452

Go to dashboard

medium5.3Runtime

Oracle Java SE: networking flaw lets unauthenticated attackers alter some data

A flaw in the Networking component of Oracle Java SE and GraalVM lets a remote, unauthenticated attacker who can send data to an exposed API change or delete some accessible data. Oracle rates it CVSS 5.3 with integrity impact only, and it requires no user action beyond the attacker supplying data to the affected API.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

5.3

medium

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 22, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Unauthorized modification or deletion of some accessible data.
CVSS said: 5.3. The facts above agree.

Who is affected

Systems running an affected Oracle Java SE, Oracle GraalVM for JDK or GraalVM Enterprise Edition build that accept untrusted data through the Networking component, such as a web service. Applications that run only trusted input, or that do not use these runtimes, can skip it. Untrusted Java Web Start applets are not the attack path described.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-91452

Go to dashboard

medium5.3Runtime

Oracle Java SE: networking flaw lets unauthenticated attackers alter some data

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

5.3

medium

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 22, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Unauthorized modification or deletion of some accessible data.
CVSS said: 5.3. The facts above agree.

Who is affected

Know the next one before it finds you.

Add to Slack

Oracle Java SE: networking flaw lets unauthenticated attackers alter some data

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

Oracle Java SE: networking flaw lets unauthenticated attackers alter some data

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources