CVE-2026-91333: Low severity Oracle Java SE vulnerability
Vulnerability in Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openjdk-21to a version that resolves this vulnerability.Fixed in 21.0.13+9-1~deb13u2 - Upgrade
Upgrade
debian/openjdk-21to a version that resolves this vulnerability.Fixed in 21.0.13+9-1 - Upgrade
Upgrade
debian/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5+8-1~deb13u1 - Upgrade
Upgrade
debian/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5+8-1 - Upgrade
Upgrade
alpine/openjdk25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3_p1-r0 - Upgrade
Upgrade
debian/openjdk-21to a version that resolves this vulnerability.Fixed in 21.0.13+9-1~deb13u2Fixed in 21.0.13.0.3+1-1 - Upgrade
Upgrade
debian/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5+8-1~deb13u1Fixed in 25.0.5+8-1Fixed in 25.0.5.0.3+1-1 - Upgrade
Upgrade
debian/openjdk-27to a version that resolves this vulnerability.Fixed in 27.0.1.0.3+1-1 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~22.04.1 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~24.04.1 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~26.10.1 - Upgrade
Upgrade
ubuntu/openjdk-27to a version that resolves this vulnerability.Fixed in 27.0.1.0.3+1-1~26.10.1 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~26.04.1
Event History
Frequently Asked Questions
Which Java deployments are most exposed?
Deployments that load and run untrusted code while relying on the Java sandbox are affected, particularly clients using sandboxed Java Web Start applications or sandboxed Java applets. Server-side exposure can also occur where a web service supplies attacker-controlled data to APIs in the affected Security component.
Does exploitation require authentication or user interaction?
No. The vulnerability is described as exploitable by an unauthenticated attacker with network access, and the CVSS vector indicates no privileges and no user interaction are required. Exploitation is difficult, however, as reflected by the high attack-complexity rating.
What is the potential impact of a successful attack?
A successful attack can allow unauthorized update, insert, or delete access to some data accessible to Oracle Java SE. The stated impact is limited to integrity; no confidentiality or availability impact is listed.
Which affected Oracle Java SE versions are identified?
The affected supported Oracle Java SE versions listed are 21.0.12.1, 25.0.4.1, and 27.