---
title: Oracle breaks its patch cycle for Java: Security Alert CVE-2026-91403 (CVSS 9.1) is an unauthenticated, network-exploitable JSSE flaw in Java SE 8 through 27 and GraalVM | ctxsec
url: https://ctxsec.com/items/oracle-java-security-alert-cve-2026-91403
description: ""
status: "confirmed (Oracle Security Alert, Rev 1, Oct 21); no exploitation stated by Oracle"
published: 2026-10-21
---

> 

[← Cybersecurity News](/news) · [markdown](/items/oracle-java-security-alert-cve-2026-91403.md)

confirmed (Oracle Security Alert, Rev 1, Oct 21); no exploitation stated by Oracle

2026-10-21

### Oracle breaks its patch cycle for Java: Security Alert CVE-2026-91403 (CVSS 9.1) is an unauthenticated, network-exploitable JSSE flaw in Java SE 8 through 27 and GraalVM

Oracle published an out-of-cycle **Security Alert for CVE-2026-91403** on **Oct 21**, the day after its October Critical Patch Update. The bug is in **JSSE**, Java's TLS implementation. It's rated **CVSS 9.1** (`AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N`) and is remotely exploitable without authentication over multiple protocols. Oracle says it can be reached through JSSE APIs, for example a web service that passes data to them, and also affects sandboxed clients that run untrusted code.

- **Affected (supported versions):** Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; GraalVM for JDK 17.0.21 and 21.0.13; GraalVM Enterprise 21.3.20. Oracle says older, unsupported releases are likely affected too.
- Oracle credits no reporter and doesn't say whether it's being exploited. It isn't in CISA KEV as of this refresh. Japan's IPA has also issued an alert urging prompt updates.

**Do now:** get the fixed builds from Oracle's Java SE patch availability document linked in the alert, and watch for matching OpenJDK distribution updates (Temurin, Corretto, Zulu, Red Hat) if you don't run Oracle's builds. Prioritize Java services that terminate TLS from untrusted clients.

Sources: [Oracle Security Alert Advisory: CVE-2026-91403 (Rev 1, Oct 21)](https://www.oracle.com/security-alerts/alert-cve-2026-91403.html) · [Oracle Security blog: Security Alert CVE-2026-91403 released](https://blogs.oracle.com/security/security-alert-cve-2026-91403-released) · [IPA: Oracle Java の脆弱性対策について (Oct 21)](https://www.ipa.go.jp/security/security-alert/2026/1021-jre.html)