CVE-2026-91463

A flaw was found in the JGSS (Java Generic Security Services) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to execute untrusted code in deployments relying on the Java sandbox. Successful exploitation can result in unauthorized access to sensitive data accessible to the Java environment.

This vulnerability is rated as having Moderate impact because exploitation requires tricking a user into executing untrusted code within an environment that relies on sandbox restrictions, combined with high attack complexity. In typical Red Hat deployments, OpenJDK is utilized for server-side infrastructure and enterprise applications that execute solely trusted code managed by administrators. Because these standard server environments do not rely on the Java security sandbox for isolation, they are not exposed under default operational configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.