Oracle patches a CVSS 9.1 Java TLS flaw in an out-of-cycle alert

Oracle patches a CVSS 9.1 Java TLS flaw in an out-of-cycle alert

21 October 2026: Oracle has issued a Security Alert, outside its quarterly patch schedule, for CVE-2026-91403, a flaw in JSSE, the Java Secure Socket Extension that implements TLS in Java SE. It scores 9.1 under CVSS 3.1 and can be exploited over the network by an attacker with no credentials and no user interaction, with high impact on confidentiality and integrity.

Not yet independently verified. Oracle's alert names the affected builds but leaves the fixed build numbers to its patch availability document, which we have not read; it says nothing on exploitation. We will update this when it can be confirmed, and remove this note.

Affected versions

• Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1
• Oracle GraalVM for JDK: 17.0.21 and 21.0.13
• Oracle GraalVM Enterprise Edition: 21.3.20

The fixed builds are listed in Oracle's Java SE patch availability document linked from the alert. Every version Oracle names, including 25.0.5 and 21.0.13, is affected, so a server brought up to those builds still needs this fix. Oracle patches only versions in Premier or Extended Support and warns that earlier releases are "likely" affected too.

What the scoring says about the flaw

Oracle publishes no technical detail, but its risk matrix is informative. The protocol is listed as "Multiple", and Oracle's rule is that secure variants of a listed protocol are affected as well, so TLS connections in general are in scope rather than one narrow feature. Attack complexity is low, no privileges are needed, and the impact is rated high for confidentiality and integrity with none for availability: the profile of a flaw that lets an attacker read or tamper with traffic or data rather than crash the service. Oracle credits no researcher.

Any Java application that opens or accepts TLS connections through the standard library is a candidate: application servers, HTTP clients calling APIs, message brokers and database drivers. GraalVM native images bake the JDK into the binary, so those applications need rebuilding with a patched GraalVM rather than a runtime update on the host.

Where the work lands

A Security Alert outside the January, April, July and October cycle is how Oracle signals urgency, and this one arrives a day after the October Critical Patch Update. Teams that build container images on an Oracle JDK base, or bundle a Java runtime inside their own product, need to rebuild and ship rather than wait for a platform update. OpenJDK builds from other vendors follow their own advisories, so estates that mix Oracle and non-Oracle Java need checking per distribution.

Related on TrustList:

• Apache Tomcat fixes a JNDIRealm password bypass and HTTP/2 mix-up
• Oracle's October update brings 1,295 patches and a 9.8 E-Business Suite flaw
• Apache fixes four Struts flaws, one of them OGNL code execution

Sources

• Oracle: Oracle Security Alert Advisory, CVE-2026-91403, 21 October 2026