Oracle published an out-of-cycle Security Alert for CVE-2026-91403 on Oct 21, the day after its October Critical Patch Update. The bug is in JSSE, Java's TLS implementation. It's rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) and is remotely exploitable without authentication over multiple protocols. Oracle says it can be reached through JSSE APIs, for example a web service that passes data to them, and also affects sandboxed clients that run untrusted code.

• Affected (supported versions): Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; GraalVM for JDK 17.0.21 and 21.0.13; GraalVM Enterprise 21.3.20. Oracle says older, unsupported releases are likely affected too.
• Oracle credits no reporter and doesn't say whether it's being exploited. It isn't in CISA KEV as of this refresh. Japan's IPA has also issued an alert urging prompt updates.

Do now: get the fixed builds from Oracle's Java SE patch availability document linked in the alert, and watch for matching OpenJDK distribution updates (Temurin, Corretto, Zulu, Red Hat) if you don't run Oracle's builds. Prioritize Java services that terminate TLS from untrusted clients.