CVE-2026-91418: Oracle Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; +3 more affected products

Affected technology

Oracle Java SE · 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27
Oracle Corporation

Oracle JavaFX · 21.0.12, 25.0.4, 27
Oracle Corporation

Oracle GraalVM for JDK · 17.0.20.1, 21.0.12.1
Oracle Corporation

Oracle GraalVM Enterprise Edition · 21.3.19.1.1
Oracle Corporation

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Unauthenticated attacker with network access via multiple protocols can compromise Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Vendor/CNA’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality and integrity impact as none; availability impact as low.