---
id: "CVE-2026-91462"
kind: "vulnerability"
aliases: ["CVE-2026-91462"]
title: "Oracle Java SE: JGSS flaw lets remote attacker alter data"
severity: "medium"
cvss: 5.9
epss: 0.00266
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["graalvm", "java", "kerberos", "oracle-jdk", "runtime", "web-services"]
not_affected_if: ["not-listed-versions"]
published_at: "2026-10-20T22:20:49+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91462", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91462", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle Java SE: JGSS flaw lets remote attacker alter data

A flaw in the JGSS component of Oracle Java SE and GraalVM lets an unauthenticated attacker with network access change or delete data by supplying crafted input to Java APIs, such as through a web service. The attack is hard to carry out, and the CVSS score is 5.9 with an integrity-only impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `java -version` and compare the reported build with the affected versions listed in the sources: `8u503`, `11.0.32.1`, `17.0.20.1`, `21.0.12.1`, `25.0.4.1`, and GraalVM `21.3.19.1.1`.
- Check whether the application's web services pass untrusted data into JGSS-backed APIs (Kerberos/GSS-API use).

## Fix

- Upgrade Oracle Java SE to a patched release from Oracle's Critical Patch Update for this CVE; the sources list the affected builds but do not name the fixed version.
- Upgrade Oracle GraalVM for JDK and GraalVM Enterprise to a patched build from Oracle.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91462
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91462

## From the sources

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_