CVE-2026-91380: Oracle Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; +2 more affected products

Affected technology

Oracle Java SE · 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27
Oracle Corporation

Oracle GraalVM for JDK · 17.0.20.1, 21.0.12.1
Oracle Corporation

Oracle GraalVM Enterprise Edition · 21.3.19.1.1
Oracle Corporation

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Local · No privileges required · No user interaction required

What an attacker can do

Unauthenticated attacker with logon can the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Vendor/CNA’s CVSS 3.1 assessment (base score 4.0/10) rates confidentiality and integrity impact as low; availability impact as none.