CVE-2026-91403: Critical Oracle Java SE and GraalVM Flaw Enables Remote Attacks

Oracle has issued an out-of-band Security Alert addressing CVE-2026-91403, a critical vulnerability affecting Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. The security issue resides in the Java Secure Socket Extension (JSSE) component and carries a CVSS v3.1 score of 9.1. The vulnerability is remotely exploitable without authentication.

Published 22-Oct-2026 16:27 UTC · First seen 22-Oct-2026 16:26 UTC

Sources

• SOC Prime · 22-Oct-2026