CVE-2026-91333

A flaw was found in the Security component of Oracle Java SE. An unauthenticated remote attacker with network access could exploit this flaw by supplying crafted input to exposed application programming interfaces (APIs) or by executing untrusted code within sandboxed environments. A successful attack allows the adversary to perform unauthorized data modifications, including inserting, updating, or deleting accessible records.

This vulnerability is rated with a Low severity impact because successful exploitation requires high attack complexity and only permits limited integrity modifications without compromising confidentiality or system availability. In typical Red Hat deployments, Java applications do not run untrusted code under a security sandbox, and exploitation through exposed network APIs depends on specific, complex cryptographic operations processing attacker-controlled data. Furthermore, earlier supported releases such as OpenJDK 8, 11, and 17 do not contain the affected code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.