Critical vulnerability in Oracle Java SE and GraalVM exposes data to attackers

## Overview Oracle disclosed a critical vulnerability, CVE-2026-91403, affecting Oracle Java SE and Oracle GraalVM products. The vulnerability resides in the JSSE component. Supported versions include Oracle Java SE 8u511, 11.0.33, 17.0.21, and others. GraalVM versions 17.0.21 and 21.3.20 are also impacted. ## Technical Details The vulnerability allows unauthenticated attackers with network access to exploit the affected components. Attackers can use multiple protocols to compromise the software. The flaw can be exploited through APIs, including those in web services that supply data to the APIs. It also affects Java deployments running sandboxed applications that load untrusted code. ## Impact Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data. Attackers could gain complete access to all data accessible by Oracle Java SE and GraalVM. The CVSS score for this vulnerability is 9.1, indicating high risk to confidentiality and integrity. ## Mitigation Defenders should prioritize updating to the latest versions of Oracle Java SE and GraalVM. Patching is essential to close this vulnerability and protect against potential data breaches. Regularly review and apply security updates from Oracle to maintain a secure environment.