---
id: "CVE-2026-91487"
kind: "vulnerability"
aliases: ["CVE-2026-91487"]
title: "Oracle Java SE Compiler flaw lets unauthenticated network attackers change some data"
severity: "medium"
cvss: 4.8
epss: 0.00168
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["graalvm", "java", "oracle-jdk", "runtime", "self-hosted", "web-services"]
not_affected_if: ["internal-only", "no-untrusted-input"]
published_at: "2026-10-20T22:20:53+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91487", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91487", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle Java SE Compiler flaw lets unauthenticated network attackers change some data

A flaw in the Compiler component of Oracle Java SE can be triggered over the network by supplying crafted data to its APIs, such as through a web service. A successful attack lets an unauthenticated attacker read and modify a subset of data the Java SE installation can access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `java -version` and compare against the affected releases: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27, GraalVM for JDK 17.0.20.1 and 21.0.12.1, GraalVM Enterprise 21.3.19.1.1.
- Check which Java runtime your services and build images actually use, including bundled JDKs inside containers.

## Fix

- Upgrade Oracle Java SE to the patched release for your line from the Oracle Critical Patch Update advisory (version numbers not listed in the sources beyond the affected ones; exact fixed builds unknown).
- Upgrade Oracle GraalVM for JDK or GraalVM Enterprise Edition to a release newer than the affected builds listed above.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91487
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91487

## From the sources

Vulnerability in Oracle Java SE (component: Compiler).  Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as  unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_