Oracle patches Java TLS flaw CVE-2026-91403, CVSS 9.1, exploitable remotely
matthew_d_green · x · 2026-10-22
Oracle has issued a security alert for CVE-2026-91403, a critical vulnerability (CVSS 9.1) in JSSE — Java's TLS implementation — that is exploitable over the network without credentials.
Affected versions include Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, plus GraalVM (Enterprise Edition 21.3.20 and JDK 17.0.21/21.0.13). Patches are available and users are urged to upgrade promptly.
More from Safety
- Agent security matures: first CVE-numbered privilege escalation ties agent risk to training conditions — krishnan · 2026-10-22
- PHP2Shell bugs were exploited in the wild days before patches landed — Wired AI · 2026-10-22
- GUDEA's AI traced 25,000 doxxing posts across platforms for NYT front page — nordicinst · 2026-10-22
- Node.js high-severity CVE-2026-111497 enables RCE via Brotli decompression — andersonbcdefg · 2026-10-22
- VX-One: Calibrated decision heads deliver sub-2ms perimeter attack triage against zero-day drift — Juan S. Santillana · 2026-10-22
- Frontier labs now run millions of agents to hunt vulnerabilities — and found some — bindureddy · 2026-10-22