Oracle published Security Alert CVE-2026-91403 (Rev 1) on 21 October 2026 for a vulnerability in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition.

Oracle says the flaw is remotely exploitable without authentication over multiple protocols and scores it CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N); Oracle's CVE record says successful attacks can result in unauthorised creation, deletion or modification of critical data or all data accessible to these products, as well as unauthorised access to critical data or complete access to all accessible data. The supported versions Oracle lists as affected are Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, Oracle GraalVM for JDK 17.0.21 and 21.0.13, and Oracle GraalVM Enterprise Edition 21.3.20.

Oracle says the flaw can be exploited through APIs in the component, for example through a web service that supplies data to them, and also applies to sandboxed Java Web Start applications or applets that load and run untrusted code. Oracle's alert credits no reporter and points to its Java SE Patch Availability Document for patches; the alert page does not list fixed build numbers or say whether the flaw has been exploited.

Correction (25 Oct 2026): Oracle's alert page, as read on 25 October (still Rev 1 of 21 October), says the Security Alert addresses CVE-2026-91403 by providing Java updates that distrust the set of impacted intermediate CA certificates related to eMudhra, and tells customers to update to the latest Java version or apply the recommended mitigations.

This card earlier said the alert did not describe the bug; that was wrong and has been removed. (source: Oracle Security Alert Advisory - CVE-2026-91403)

UPDATE (25 Oct 2026): Oracle published a second Security Alert, CVE-2026-114820 (Rev 1, 24 October), which it says provides Java updates that remove the set of impacted root CA certificates related to eMudhra. Oracle again places the issue in the JSSE component, scores it CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and lists as affected Oracle Java SE 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2 and 27.0.1.0.2, Oracle GraalVM for JDK 17.0.21.0.2 and 21.0.13.0.2, and Oracle GraalVM Enterprise Edition 21.3.20.0.2.

Oracle says to update to the latest Java version or apply the recommended mitigations; the alert does not list fixed build numbers. (source: Oracle Security Alert Advisory - CVE-2026-114820)