CVE-2026-91464

A flaw was found in OpenJDK's Java Generic Security Services (JGSS) component. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to execute untrusted code within a sandboxed Java environment. Successful exploitation results in unauthorized information disclosure, allowing the attacker to access sensitive data accessible to the application.

This vulnerability is assessed as Moderate impact because exploitation requires high attack complexity and user interaction to execute untrusted code inside an isolated Java sandbox. In typical Red Hat deployments, OpenJDK powers server-side applications running exclusively trusted administrative code rather than untrusted client applets. As enterprise workloads do not depend on the deprecated Java sandbox mechanisms for security, standard deployments are not exposed to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.