CVE-2026-91379

A flaw was found in OpenJDK's JDK tools component. An unauthenticated local attacker can exploit this vulnerability by convincing a user to interact with untrusted code in an environment relying on the Java security sandbox. A successful attack can result in unauthorized creation, modification, or deletion of critical data accessible to the application.

This vulnerability is rated Moderate rather than Important because exploitation requires local access, user cooperation, and reliance on Java security sandbox boundaries to constrain untrusted code. Red Hat Enterprise Linux deployments predominantly run server-side Java applications that execute only administrator-provisioned trusted bytecode. Because standard production workflows do not process unvetted scripts through interactive JDK tools such as JShell, most enterprise installations are not exposed to this issue under default operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.