Description
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Published: 2026-10-20
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Title Partial Denial of Service via Unauthenticated Network Access to CORBA APIs in Oracle Java SE and Oracle GraalVM Enterprise Edition openjdk: Enhance CORBA (Oracle CPU 2026-10)
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Oracle oracle Java Se
Vendors & Products Oracle oracle Java Se

Wed, 21 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Title Partial Denial of Service via Unauthenticated Network Access to CORBA APIs in Oracle Java SE and Oracle GraalVM Enterprise Edition
Weaknesses CWE-770

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
First Time appeared Oracle
Oracle graalvm
Oracle java Se
CPEs cpe:2.3:a:oracle:graalvm:21.3.19.1.1:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:java_se:8u503:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u503:*:*:*:enterprise_performance:*:*:*
Vendors & Products Oracle
Oracle graalvm
Oracle java Se
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Oracle Graalvm Java Se Oracle Java Se
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T18:50:23.419Z

Reserved: 2026-09-14T22:10:16.633Z

Link: CVE-2026-91417

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:45.067

Modified: 2026-10-22T19:18:05.000

Link: CVE-2026-91417

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-20T21:25:51Z

Links: CVE-2026-91417 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T15:45:06Z

Weaknesses