Vulnerabilities · 4h ago

Oracle Java sandboxing may not contain critical JSSE flaw

INCIBE reports that Oracle’s October 22, 2026 advisory covers one critical, remotely exploitable flaw in the Java Secure Socket Extension (JSSE) component of Oracle Java SE and GraalVM: CVE-2026-91403.

Oracle says the flaw can be exploited over a network without authentication and could affect system confidentiality and integrity. The advisory also says Java deployments running untrusted code in sandboxed applications may be affected, but does not describe an exploitation path.

If your Java applications use sandboxing to run untrusted code, the advisory puts those deployments in scope without explaining how the flaw interacts with that isolation. Sandboxing alone therefore cannot be assumed to rule out exposure; the source does not say which sandbox configurations are affected.

CVE-2026-91403

NVD KEV

Published Oct 21 by Oracle

CVSS 9.1 CRITICAL: vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).

Timeline

Sources

1 source covering this story

Entities

Part of the PlainSec briefing for 2026-10-22

Editions

Related stories