# CVE-2026-91403: Critical Oracle Java SE and GraalVM JSSE Flaw Enables Unauthenticated Remote Attacks (CVSS 9.1)

> CVE-2026-91403 is a critical (CVSS v3.1 9.1) flaw in the Java Secure Socket Extension (JSSE) component of Oracle Java SE and GraalVM that lets an unauthenticated network attacker read and modify critical data. Oracle issued a Security Alert on 2026-10-21; no public PoC, in-the-wild exploitation, or CISA KEV listing was reported as of 2026-10-22.

- **Published:** 2026-10-22T11:47:06Z
- **Last reviewed:** 2026-10-22T11:47:06Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4138
- **ID:** TL-2026-4138
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-91403

## Description

CVE-2026-91403 affects the Java Secure Socket Extension (JSSE) component of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition. NVD describes it as a vulnerability that allows an unauthenticated attacker with network access to compromise affected products, resulting in unauthorized creation, deletion or modification access to critical data and complete access to all data accessible to the affected product. SOC Prime reports the issue is exploitable through multiple protocols with no authentication and no user interaction required.

The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 CRITICAL): network-reachable, low complexity, no privileges, no user interaction, unchanged scope, high confidentiality and integrity impact, and no availability impact. Because JSSE implements TLS/SSL for Java client and server applications, any internet-facing or internal Java service that terminates or initiates TLS through JSSE should be treated as potentially in scope until patched. No CWE is assigned in the sources reviewed, and the precise root cause has not been disclosed publicly.

Affected versions per SOC Prime and NVD: Oracle Java SE 8u511 (SOC Prime also lists 8u511-perf), 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1; Oracle GraalVM for JDK 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition 21.3.20. Oracle published Security Alert alert-cve-2026-91403 on 2026-10-21 with patches. The CVE was reserved on 2026-09-14.

Exploitation status: SOC Prime reports no public proof-of-concept, no published indicators of compromise, no confirmed in-the-wild exploitation, and no threat actor or malware attribution. The CISA KEV catalog (version 2026.10.21, released 2026-10-21) was checked and the portion read did not contain this CVE; the full catalog was not read, so absence is not fully confirmed. This record therefore documents a patch-priority vulnerability rather than an active campaign. Because there are no network or file IOCs, the IOC set lists vulnerable-version indicators for asset inventory and exposure hunting, not compromise indicators. No BeaconBeagle lookup was run because no network IOCs exist.

Defender guidance: inventory all Java installations including embedded runtimes and vendor-bundled JREs, apply the Oracle Security Alert patches, temporarily restrict network access to vulnerable TLS-terminating Java services, monitor for unexpected data modification or deletion in Java-backed applications, and rotate credentials and secrets if compromise is suspected.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1005 Data from Local System
- T1565.001 Stored Data Manipulation
- T1565.002 Transmitted Data Manipulation
- T1485 Data Destruction

## Sources

- [CVE-2026-91403: Critical Oracle Java SE and GraalVM Flaw Enables Remote Attacks](https://socprime.com/blog/cve-2026-91403-analysis/)
- [Oracle Security Alert CVE-2026-91403](https://www.oracle.com/security-alerts/alert-cve-2026-91403.html)
- [NVD - CVE-2026-91403](https://nvd.nist.gov/vuln/detail/CVE-2026-91403)
- [NVD CVE API 2.0 record for CVE-2026-91403](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-91403)
- [CISA Known Exploited Vulnerabilities Catalog (v2026.10.21)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Oracle Security Alerts index](https://www.oracle.com/security-alerts/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4138