{"id":"CVE-2026-91462","kind":"vulnerability","aliases":["CVE-2026-91462"],"related":[],"title":"Oracle Java SE: JGSS flaw lets remote attacker alter data","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).","summary":"A flaw in the JGSS component of Oracle Java SE and GraalVM lets an unauthenticated attacker with network access change or delete data by supplying crafted input to Java APIs, such as through a web service. The attack is hard to carry out, and the CVSS score is 5.9 with an integrity-only impact.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["graalvm","java","kerberos","oracle-jdk","runtime","web-services"],"not_affected_if":["not-listed-versions"],"how_to_check":"- Run `java -version` and compare the reported build with the affected versions listed in the sources: `8u503`, `11.0.32.1`, `17.0.20.1`, `21.0.12.1`, `25.0.4.1`, and GraalVM `21.3.19.1.1`.\n- Check whether the application's web services pass untrusted data into JGSS-backed APIs (Kerberos/GSS-API use).","fix":"- Upgrade Oracle Java SE to a patched release from Oracle's Critical Patch Update for this CVE; the sources list the affected builds but do not name the fixed version.\n- Upgrade Oracle GraalVM for JDK and GraalVM Enterprise to a patched build from Oracle.","status":"open","published_at":"2026-10-20T22:20:49+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T04:08:07+00:00","updated_at":"2026-10-25T04:08:07+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:08:07Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Oracle Java SE to a patched release from Oracle's Critical Patch Update for this CVE; the sources list the affected builds but do not name the fixed version.\n- Upgrade Oracle GraalVM for JDK and GraalVM Enterprise to a patched build from Oracle.","reach":"internet","title":"Oracle Java SE: JGSS flaw lets remote attacker alter data","impact":"medium","summary":"A flaw in the JGSS component of Oracle Java SE and GraalVM lets an unauthenticated attacker with network access change or delete data by supplying crafted input to Java APIs, such as through a web service. The attack is hard to carry out, and the CVSS score is 5.9 with an integrity-only impact.","category":"runtime","nicknames":[],"who_cares":["java","oracle-jdk","graalvm","kerberos","web-services"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker can alter or delete data the Java application can access.","analyst_note":"Check Oracle's Critical Patch Update advisory for the fixed Java build numbers and the list of JGSS APIs affected.","how_to_check":"- Run `java -version` and compare the reported build with the affected versions listed in the sources: `8u503`, `11.0.32.1`, `17.0.20.1`, `21.0.12.1`, `25.0.4.1`, and GraalVM `21.3.19.1.1`.\n- Check whether the application's web services pass untrusted data into JGSS-backed APIs (Kerberos/GSS-API use).","needs_analyst":true,"not_affected_if":["not-listed-versions"],"who_is_affected":"Teams running Oracle Java SE 8, 11, 17, 21, or 25 builds listed above, or Oracle GraalVM for JDK or Enterprise builds, especially services that accept network input and call JGSS APIs. Systems that do not run these builds can skip it. The sources do not say which JGSS APIs are most exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000739,"input_tokens":3745,"output_tokens":728,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-91462':13A,16A '/av':235C '11.0.32.1':116C '17.0.20.1':117C,125C '21.0.12.1':118C,127C '21.3.19.1.1':132C '25.0.4.1':119C '27':120C '3.1':225C,234C '5.9':75B,228C '8u503':112C,114C '8u503-perf':113C 'access':45B,142C,172C,189C 'affect':107C 'allow':137C 'alter':9A 'api':56B,202C 'applet':217C 'applic':213C 'attack':8A,42B,64B,139C,160C 'base':226C 'carri':68B 'chang':46B 'compon':32B,101C,206C 'compromis':147C 'craft':52B 'creation':168C 'critic':174C 'cve':11A,14A 'cvss':72B,224C,231C,233C 'data':10A,49B,175C,190C,200C 'delet':48B,169C 'difficult':133C 'edit':95C,131C,158C,188C 'enterpris':94C,130C,157C,187C 'exploit':135C,197C 'flaw':5A,28B 'graalvm':17B,38B,89C,93C,122C,129C,152C,156C,182C,186C 'h/a':242C 'h/pr':237C 'hard':66B 'impact':81B,230C 'input':53B 'integr':79B,229C 'integrity-on':78B 'java':2A,18B,35B,55B,86C,99C,110C,149C,179C,210C,216C 'jdk':22B,91C,124C,154C,184C 'jgss':4A,31B,102C 'kerbero':19B 'let':6A,39B 'modif':171C 'multipl':144C 'n':243C 'n/ac':236C 'n/i':241C 'n/s':239C 'n/ui':238C 'network':44B,141C 'note':191C 'oracl':1A,21B,34B,85C,88C,92C,98C,109C,121C,128C,148C,151C,155C,178C,181C,185C 'oracle-jdk':20B 'perf':115C 'product':96C 'protocol':145C 'remot':7A 'result':165C 'runtim':23B 'score':73B,227C 'se':3A,36B,87C,100C,111C,150C,180C 'servic':26B,62B,223C 'specifi':205C 'start':212C 'success':159C 'suppli':51B,199C 'support':103C 'u/c':240C 'unauthent':41B,138C 'unauthor':167C 'untrust':209C,215C 'use':208C 'vector':232C 'version':104C 'via':143C 'vulner':82C,136C,163C,193C 'web':25B,61B,211C,222C 'web-servic':24B 'without':207C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle Java SE 8, 11, 17, 21, or 25 builds listed above, or Oracle GraalVM for JDK or Enterprise builds, especially services that accept network input and call JGSS APIs. Systems that do not run these builds can skip it. The sources do not say which JGSS APIs are most exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91462","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91462","severity":null,"published_at":"2026-10-20T22:20:49+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}