Oracle has pushed out an out-of-band fix for Java, outside its usual quarterly patch schedule. The Security Alert for CVE-2026-91403, published on October 21, 2026, covers a single vulnerability that Oracle scores 9.1 out of 10 and says can be exploited remotely over a network without any user credentials.
Oracle reserves Security Alerts for issues it judges too important to hold for the next Critical Patch Update, which makes this one worth putting at the front of the queue for anyone running Java in production.
Every supported Java line is on the list
The flaw sits in JSSE, the Java Secure Socket Extension, which is the part of Java that handles TLS connections. Oracle lists these supported versions as affected:
- Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1
- Oracle GraalVM for JDK 17.0.21 and 21.0.13
- Oracle GraalVM Enterprise Edition 21.3.20
Oracle adds that releases outside Premier or Extended Support are not tested, and that earlier versions of affected releases are "likely" vulnerable too, so it recommends upgrading to a supported version rather than assuming an old build is safe.
What Oracle's score says, and what it does not
Oracle's CVSS 3.1 rating describes an attack over the network, with low complexity, requiring no privileges and no user interaction. It rates the impact on confidentiality and integrity as high and the impact on availability as none. Oracle says the flaw can be exploited through APIs in the affected component, for example through a web service that supplies data to those APIs, and that it also applies to client deployments that run untrusted, sandboxed Java Web Start applications or applets.
Oracle has not published technical details of the bug, and its advisory does not say whether it has been exploited in the wild. Hong Kong's HKCERT relayed the alert in a security bulletin on October 22, describing the impact as security restriction bypass and data manipulation and rating it medium risk on its own scale, lower than Oracle's own score.
Apply the Java SE Security Alert patch now
Oracle's advisory links to the Java SE Patch Availability Document, which lists the fixed builds for each release line. Administrators should:
- Inventory servers, application containers and desktop images that bundle Java SE or GraalVM, including copies shipped inside third-party products.
- Apply the Security Alert update for each affected line, prioritising internet-facing services that accept TLS connections.
- Check with vendors whose software embeds an Oracle JRE for their own updated builds.
Java remains embedded in a vast amount of enterprise software, often in places nobody remembers installing it. An out-of-cycle fix with a 9.1 score and no authentication requirement is exactly the kind of patch that gets lost in that sprawl. For broader context on patch prioritisation, see our recent coverage of the PHP2Shell fixes.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.