Back Hkcert

Oracle Java Security Restriction Bypass Vulnerability

Hkcert • October 22, 2026

A vulnerability has been identified in Oracle Java. A remote attacker could exploit some of these vulnerabilities to trigger security restriction bypass and data manipulation on the targeted system.

Security Restriction Bypass

System / Technologies affected

Oracle GraalVM Enterprise Edition, version 21.3.20

Oracle GraalVM for JDK, versions 17.0.21, 21.0.13

Oracle Java SE, versions 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

Vulnerability Identifier

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Oracle Java Vulnerability CVE-2026-91403 Disclosed A critical vulnerability, CVE-2026-91403, has been identified in Oracle Java SE and GraalVM products. Affected versions include Oracle Java SE 8u511, 11.0.33, 17.0.21, and others, as well as GraalVM for JDK 17.0.21 and 21.0.13. The flaw allows unauthenticated attackers with network access to exploit the vulnerability, leading to unauthorized data manipulation and access. The vulnerability can be exploited via APIs, including through web services that supply data to these APIs. The CVSS score for this vulnerability is 9.1, indicating a critical severity level. Users are urged to apply patches as they become available. The vulnerability was published on October 21, 2026. 2 sources 78

Extracted Entities

Platforms (3)

Oracle GraalVM Enterprise Edition Oracle GraalVM For JDK Oracle Java SE