Java has a 9.1 split loophole, CVE-2026-91403, but I looked around the Oracle bulletin and found two big holes.
First, the conclusion is that:CVE-2026-91403 is true, CVSS 3.1 beat 9.1, and indeed serious. But it's not in this season's CPU bulletin, and there's no "coding" in 9.1 minutes.If you don't get it all figured out, you'll get the rhythm and the order wrong.
This hole was passed by Oracle on October 21, 2026. Security Alert Single-pointed, not a one from the Quarterly Patch Update. The components are JSSE 8u511, 11.0.33, 17.0.21, 1.01.13, 25.0.5, 27.0.1, plus GraalVM for JDK 17.02.13 and GraalVM EE 21.3.20.
And I'd like to point out, by title, that I'd go over Oracle's bulletin system and find two pits worth writing more than the hole itself. Because these two pits are not the problem.All teams working on the Quarterly Sweeper Bulletin will step on it.Yeah.
I. Pit One: It's not in the CPU this quarter.
This is the most anti-intuitive. Many people (including me a month ago) have a default on Oracle's security rhythm: Quarterly CPU, once in October, sweep 1295 patches and it's over.
But Oracle's public announcement is actually three pools:
- Catholic Patch Update (CPU)- Quarterly batches, all together.
- Security Alert— Urgent single dots, not integrated into the quarterly rhythm, a CVE might open a single page.
- Creative Security Patch Update— A patch between the two.
CVE-2026-91403.Second pool.I don't know. I went through the full text of the CPU bulletin -- 1295 new patches, of which Java SE was 55, 49 could be used remotely without authorization --Full text search CVE-2026-91403, 0 hits.
What does that mean? If your asset flow is a "quarterly CVE list of CPUs, lead to the loophole, schedule the repairs," it's a loophole.Never on your list.I don't know. It's not missing, it's the pipe that doesn't cover the data source.
And Oracle added a special passage to the Security Alert to the effect that Security Alert's patchesOnly cover versions in the Premier Support or Extended Support phase, a version that is not in the support cycle will not be tested. Translation is -- don't come looking for me in the old version.
By the way, two versions of the tables are not up.
This pit was discovered during the investigation, and is even more alarming.
In the same October rhythm, Java SE appeared with two completely different versions: CPU, comprising 8u503, 11.0.32.1, 17.0.20.1, 1.01.12.1, 25.04.4, 6.2, 27; Security Alert, 8,511, 11.0.33, 17.0.21, 1.01.1.3, 25.0.5, 27.0.1.
It's not an error. It's two different updates. I thought, "I'm done with the CPU this quarter," and it wasn't the same version.The most dangerous of these circumstances is not the absence of patches, but the fact that they are made safe.
II. Pit II: 9.1 minutes, but not RCE
It's more subtle and easier to miss the title.
CVE-2026-91403 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NOpen it.
| Dimensions | Take Value | Meaning |
|---|---|---|
| AV Attack Vector | N (Network) | Remote access |
| AC complexity of attack | L (low) | There's no need for a bunch of preconditions. |
| PR Permissions Required | N (none) | You can start without authentication. |
| UI User Interactive | N (none) | You don't have to lie to anyone about the link. |
| S Scope of Action | U (No change) | Impact limited to its own safe domain |
| C Confidentiality | H (High) | Key data accessible |
| I Integrity | H (High) | Key data can be created/ deleted/modified |
| A Availability | N (none) | Oracle did not indicate the disruption effects of the service |
The last line is the key.None.
Oracle's original description is for unauthorized creation, deletion or modification of access rights, plus unauthorized access to key data.The word remote code exception does not appear throughout.
It's not slang. 9.1 The point is C:H + I:H held up — readable, modified, destructive. But "can read change" and "can enforce any code." There are two things to deal with: the former often means that the data surface is penetrating, and the latter means that the whole machine is shifting. You rank them in fractions, and you rank them in semantics.
One more detail: Oracle says the hole.It could affect Java deployments that load and run untrustworthy codes.The typical scene is the Java Web Start application and applet in the sandbox, under the Java sandbox. It's a rare scene now, but if you have it in your old system, it's another thing because the nature of the sandbox changes once it's worn.
Plus, the calibration of the pit: Oracle clearly said its CVSS scoreAssume that users running applet or WebStart have administrator privileges(Windows common) When the user is not an administrator (common on Solaris, Linux), the impact score for confidentiality, integrity and usability is reduced from High to Low, followed by a large percentage of the benchmark.The same CVE can be completely different on different platforms.
Three, one hole, three layers.
The two pits actually point to the same methodological issue:We are all sorted in fractions, but no one breaks the semantics and the sources.
First level: bulletin system - in which pool it goes
This determines whether your automated pipe can get it. CPU, Security Alert, CSPU are three different channels, with different rhythms, coverage and even URL structures. Just the CPU process, naturally missing all emergency single points.
The least convenient way to do that is to get the manufacturer.CVE to the bulletin mapConsider it the only entrance, not a specific announcement. Oracle provides its own Map of CVE to Advisory/Alert, which is more reliable than any CPU page.
Second level: the semantics of the rating - 9.1 - which are the points?
CVSS is a decomposition amount, not a ranking. C:H/I:H/A:N 9.1 and C:H/I:H/A:H:H, 9.1, the disposal priority should be different — the former being “data tampered” and the latter being “services hung up” plus the first two.
More practical:It's useful to see vectors over points.AC:L + PR:N + UI:N, taken together, means that the face of the attack is completely open, without any preconditions. Even with a score of seven, this hole is much more likely to be used than those nine points that are linked.
Level 3: Supply chain - Whose construction is it?
Oracle JDK is just one of them. You might run online with a distribution builder of OpenJDK, a custom JDK for a cloud manufacturer, or a third-party builder packed into a container mirror.CVE fixes are not fixed, depending on whether that vendor didn't put the upstream patch in, and Oracle hairless patch is two things.
So don't look at Oracle's announcement and look at his Oracle JDK version -- find out who you really are. It's not working. It's useless.
What should we do?
- Confirm the version first.Run!
java -version, compare the table above. 8u511 / 11.0.33 / 17.0.21 / 21.0.13 / 25.0.5 / 27.0.1 These are affected and not restored versions. - Do not subscribe only to CPU.Integrates the security Alert and CSPU into the surveillance, using the CVE-to-Advisory map as an entry and not relying on a single page.
- Open the vector and sort it.At least pull out the A (availability) item and not replace the word "9.1" with the word "9.1".
- Check it out, vendor.That's the real path to repair.
- Don't count on mitigation measures.In this announcement, Oracle didn't give it to the world, and the credit statements were written by Noon Credite -- neither by who did it, nor by the bypass. There is only one way to patch this up.
There's another asset-management item:Save the word "publicity type" as a field.CPU and Security Alert should have been different in responding to SLA - the former can go through quarterly windows and the latter follows an emergency process. In a watch, the emergency is delayed to the end of the season.
V. CONTEXT OF THE FINAL STATEMENT
This loophole itself, 9.1 points, unauthorized, networkable, non-interactive, readable — it should be repaired and prioritized.
But what it brought me wasn't the loophole itself, but it was...How did it get out of my sight?: an emergency patch not included in the quarterly bulletin, an unmatched version number, a 9.1 point without RCE. The three things that happen in isolation are not fatal, and they come together and they're like, "I thought I was done, but I didn't see them."
The loophole is not terrible, it is terrible that you have no place in your process.
By the way, take a note of the data and make it easier for you to check yourself: during the quarter, CPU had a total of 1295 new patches, Java SE accounted for 55, 49 of which were remotely unauthorised; CVE-2026-91403 went Security Alert, 21 October 2026, Rev 1, which covered only Java SE as a product line.
Here's the link:Oracle Security Alert – CVE-2026-91403I don't know. If you want to see the text of the risk-by-risk matrix, there's a link on the bulletin page.