{"id":"CVE-2026-91487","kind":"vulnerability","aliases":["CVE-2026-91487"],"related":[],"title":"Oracle Java SE Compiler flaw lets unauthenticated network attackers change some data","description":"Vulnerability in Oracle Java SE (component: Compiler).  Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as  unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).","summary":"A flaw in the Compiler component of Oracle Java SE can be triggered over the network by supplying crafted data to its APIs, such as through a web service. A successful attack lets an unauthenticated attacker read and modify a subset of data the Java SE installation can access.","severity":"medium","cvss":4.8,"epss":0.00168,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["graalvm","java","oracle-jdk","runtime","self-hosted","web-services"],"not_affected_if":["internal-only","no-untrusted-input"],"how_to_check":"- Run `java -version` and compare against the affected releases: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27, GraalVM for JDK 17.0.20.1 and 21.0.12.1, GraalVM Enterprise 21.3.19.1.1.\n- Check which Java runtime your services and build images actually use, including bundled JDKs inside containers.","fix":"- Upgrade Oracle Java SE to the patched release for your line from the Oracle Critical Patch Update advisory (version numbers not listed in the sources beyond the affected ones; exact fixed builds unknown).\n- Upgrade Oracle GraalVM for JDK or GraalVM Enterprise Edition to a release newer than the affected builds listed above.","status":"open","published_at":"2026-10-20T22:20:53+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T04:33:13+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:33:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Oracle Java SE to the patched release for your line from the Oracle Critical Patch Update advisory (version numbers not listed in the sources beyond the affected ones; exact fixed builds unknown).\n- Upgrade Oracle GraalVM for JDK or GraalVM Enterprise Edition to a release newer than the affected builds listed above.","reach":"internet","title":"Oracle Java SE Compiler flaw lets unauthenticated network attackers change some data","impact":"medium","summary":"A flaw in the Compiler component of Oracle Java SE can be triggered over the network by supplying crafted data to its APIs, such as through a web service. A successful attack lets an unauthenticated attacker read and modify a subset of data the Java SE installation can access.","category":"runtime","nicknames":[],"who_cares":["java","oracle-jdk","graalvm","self-hosted","web-services"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads and modifies some data the Java SE runtime can access","analyst_note":"Check the Oracle Critical Patch Update advisory for the exact fixed Java SE and GraalVM builds and whether specific exploit details exist.","how_to_check":"- Run `java -version` and compare against the affected releases: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27, GraalVM for JDK 17.0.20.1 and 21.0.12.1, GraalVM Enterprise 21.3.19.1.1.\n- Check which Java runtime your services and build images actually use, including bundled JDKs inside containers.","needs_analyst":true,"not_affected_if":["no-untrusted-input","internal-only"],"who_is_affected":"Systems running an affected Oracle Java SE or GraalVM release that expose Java code paths which pass untrusted data into the affected Compiler APIs, such as web services that accept input the server processes through the compiler component. Installations that only run trusted code, or that do not take data from outside the machine, have a much smaller exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000741,"input_tokens":3629,"output_tokens":756,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-91487':15A,18A '/av':217C '11.0.32.1':99C '17.0.20.1':100C,108C '21.0.12.1':101C,110C '21.3.19.1.1':115C '25.0.4.1':102C '27':103C '3.1':205C,216C '4.8':208C '8u503':97C '8u503-perf':96C 'access':79B,125C,147C,154C,161C,169C 'affect':91C 'allow':120C 'api':53B,182C 'applet':197C 'applic':193C 'attack':9A,62B,66B,122C,135C 'base':206C 'chang':10A 'compil':4A,35B,86C 'compon':36B,85C,186C 'compromis':130C 'confidenti':209C 'craft':49B 'cve':13A,16A 'cvss':204C,213C,215C 'data':12A,50B,73B,155C,170C,180C 'delet':146C 'difficult':116C 'edit':114C 'enterpris':113C 'exploit':118C,177C 'flaw':5A,32B 'graalvm':19B,105C,112C 'h/pr':219C 'host':27B 'impact':212C 'insert':144C 'instal':77B 'integr':211C 'java':2A,20B,39B,75B,83C,94C,132C,152C,167C,190C,196C 'jdk':23B,107C 'l/a':224C 'l/i':223C 'let':6A,63B 'modifi':69B 'multipl':127C 'n':225C 'n/ac':218C 'n/s':221C 'n/ui':220C 'network':8A,46B,124C 'note':171C 'oracl':1A,22B,38B,82C,93C,104C,111C,131C,151C,166C 'oracle-jdk':21B 'perf':98C 'protocol':128C 'read':67B,160C 'result':140C 'runtim':24B 'score':207C 'se':3A,40B,76B,84C,95C,133C,153C,168C 'self':26B 'self-host':25B 'servic':30B,59B,203C 'specifi':185C 'start':192C 'subset':71B,164C 'success':61B,134C 'suppli':48B,179C 'support':87C 'trigger':43B 'u/c':222C 'unauthent':7A,65B,121C 'unauthor':142C,159C 'untrust':189C,195C 'updat':143C 'use':188C 'vector':214C 'version':88C 'via':126C 'vulner':80C,119C,138C,173C 'web':29B,58B,191C,202C 'web-servic':28B 'well':157C 'without':187C","nicknames":[],"mitigations":[],"who_affected":"Systems running an affected Oracle Java SE or GraalVM release that expose Java code paths which pass untrusted data into the affected Compiler APIs, such as web services that accept input the server processes through the compiler component. Installations that only run trusted code, or that do not take data from outside the machine, have a much smaller exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91487","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91487","severity":null,"published_at":"2026-10-20T22:20:53+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91487","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91487","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}