CVE-2026-91374

A flaw was found in the Serviceability component of OpenJDK. An unauthenticated remote attacker can exploit this issue across the network by supplying crafted data to exposed application programming interfaces (APIs) or by running untrusted code within a sandboxed Java environment. Successful exploitation may lead to unauthorized data access, allowing the attacker to read and modify sensitive application data.

This vulnerability is evaluated as having a Moderate impact for Red Hat Enterprise Linux and OpenJDK environments because successful exploitation requires high attack complexity, such as untrusted sandboxed execution or network exposure of internal serviceability endpoints. In standard Red Hat deployments, diagnostic and serviceability tools are not active by default, and typical workloads do not expose these interfaces to unauthenticated network actors. Furthermore, the maximum impact is constrained to partial data disclosure and modification, without causing service disruption or providing full system compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.