Threat reportVulnerabilityTL-2026-4138
CVE-2026-91403: Critical Oracle Java SE and GraalVM JSSE Flaw Enables Unauthenticated Remote Attacks (CVSS 9.1)
CVE-2026-91403 (TL-2026-4138) is a critical-severity software vulnerability scored CVSS 9.1, first published 2026-10-22. It has no confirmed attribution, affects Oracle Java SE, references 1 CVE (CVE-2026-91403), maps to 5 MITRE ATT&CK techniques (T1005, T1190, T1485), and is covered by 9 detection rules and 11 indicators of compromise.
- CVSS
- 9.1/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-4138
- Threat ID
- TL-2026-4138
- Severity
- CRITICAL
- CVSS
- 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, finance, government administration, health, telecoms, retail
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 11
How CVE-2026-91403 works
CVE-2026-91403 is a critical (CVSS v3.1 9.1) flaw in the Java Secure Socket Extension (JSSE) component of Oracle Java SE and GraalVM that lets an unauthenticated network attacker read and modify critical data. Oracle issued a Security Alert on 2026-10-21; no public PoC, in-the-wild exploitation, or CISA KEV listing was reported as of 2026-10-22.
CVE-2026-91403 affects the Java Secure Socket Extension (JSSE) component of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition. NVD describes it as a vulnerability that allows an unauthenticated attacker with network access to compromise affected products, resulting in unauthorized creation, deletion or modification access to critical data and complete access to all data accessible to the affected product. SOC Prime reports the issue is exploitable through multiple protocols with no authentication and no user interaction required.
The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 CRITICAL): network-reachable, low complexity, no privileges, no user interaction, unchanged scope, high confidentiality and integrity impact, and no availability impact. Because JSSE implements TLS/SSL for Java client and server applications, any internet-facing or internal Java service that terminates or initiates TLS through JSSE should be treated as potentially in scope until patched. No CWE is assigned in the sources reviewed, and the precise root cause has not been disclosed publicly.
Affected versions per SOC Prime and NVD: Oracle Java SE 8u511 (SOC Prime also lists 8u511-perf), 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1; Oracle GraalVM for JDK 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition 21.3.20. Oracle published Security Alert alert-cve-2026-91403 on 2026-10-21 with patches. The CVE was reserved on 2026-09-14.
Exploitation status: SOC Prime reports no public proof-of-concept, no published indicators of compromise, no confirmed in-the-wild exploitation, and no threat actor or malware attribution. The CISA KEV catalog (version 2026.10.21, released 2026-10-21) was checked and the portion read did not contain this CVE; the full catalog was not read, so absence is not fully confirmed. This record therefore documents a patch-priority vulnerability rather than an active campaign. Because there are no network or file IOCs, the IOC set lists vulnerable-version indicators for asset inventory and exposure hunting, not compromise indicators. No BeaconBeagle lookup was run because no network IOCs exist.
Defender guidance: inventory all Java installations including embedded runtimes and vendor-bundled JREs, apply the Oracle Security Alert patches, temporarily restrict network access to vulnerable TLS-terminating Java services, monitor for unexpected data modification or deletion in Java-backed applications, and rotate credentials and secrets if compromise is suspected.
MITRE ATT&CK techniques used in TL-2026-4138
Collection
Initial Access
T1190 Exploit Public-Facing Application
Impact
T1485 Data Destruction; T1565.001 Stored Data Manipulation; T1565.002 Transmitted Data Manipulation
Affected products and versions in CVE-2026-91403
- Oracle — Java SE
Vulnerable versions: 8u511; 8u511-perf; 11.0.33; 17.0.21; 21.0.13; 25.0.5; 27.0.1
Fixed in: See Oracle Security Alert alert-cve-2026-91403 - Oracle — GraalVM for JDK
Vulnerable versions: 17.0.21; 21.0.13
Fixed in: See Oracle Security Alert alert-cve-2026-91403 - Oracle — GraalVM Enterprise Edition
Vulnerable versions: 21.3.20
Fixed in: See Oracle Security Alert alert-cve-2026-91403
Remediation for CVE-2026-91403
Patches
- Oracle Security Alert for CVE-2026-91403 (2026-10-21); specific fixed build numbers are in the Oracle alert, which could not be retrieved (HTTP 403)
Immediate actions
- Apply the patches referenced in Oracle Security Alert alert-cve-2026-91403 (published 2026-10-21)
- Inventory all Java installations, including embedded and vendor-bundled runtimes, and identify those at the affected versions
- Temporarily restrict network access to vulnerable TLS-terminating Java services until patched
Workarounds
- Restrict network exposure of affected Java services
- Rotate potentially exposed credentials if compromise is suspected
Longer-term hardening
- Maintain a software bill of materials covering Java runtimes and GraalVM builds
- Monitor for unexpected creation, modification or deletion of application data in Java-backed services
- Track CISA KEV and vendor channels for exploitation updates on this CVE
CVEs associated with CVE-2026-91403
Timeline of CVE-2026-91403
- CVE-2026-91403 reserved
- CISA KEV catalog version 2026.10.21 released; the portion reviewed does not list CVE-2026-91403
- NVD publishes CVE-2026-91403 with CVSS v3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
- Oracle publishes Security Alert for CVE-2026-91403 with patches for Java SE, GraalVM for JDK and GraalVM Enterprise Edition
- Threadlinqs opens tracking record TL-2026-4138 (patch available, exploitation not observed)
- SOC Prime publishes analysis reporting no public PoC, no IOCs, no confirmed exploitation and no KEV listing
Sources cited for CVE-2026-91403
Detection coverage for TL-2026-4138
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4138 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.