Critical Java JSSE Vulnerability CVE-2026-91403 (CVSS 9.1) Affects All Major JDK Versions

Severity Breakdown

Oracle disclosed CVE-2026-91403 on October 21, 2026, a critical vulnerability in JSSE (Java Secure Socket Extension) with CVSS 3.1 score 9.1 (CRITICAL). The flaw allows remote exploitation over the network with low attack complexity, no privileges required, and no user interaction, resulting in complete loss of confidentiality and integrity.

CVE ID : CVE-2026-91403

Component : JSSE (Java Secure Socket Extension)

CVSS 3.1 Score : 9.1 (CRITICAL)

Attack Vector : Network (AV:N)

Attack Complexity : Low (AC:L)

Privileges Required : None (PR:N)

User Interaction : None (UI:N)

Impact : Complete loss of confidentiality and integrity

Source: https://www.cve.org/CVERecord?id=CVE-2026-91403 In practical terms: an attacker needs no credentials, no user interaction, and low complexity to remotely exploit any Java application exposing a TLS service, reading or tampering with encrypted traffic.

Root Cause Analysis

Oracle's advisory states only that JSSE is vulnerable via "web services providing data to APIs." Combined with the CVSS vector (AC:L, PR:N, UI:N), the following inferences can be made:

Input validation or state management flaw in TLS handshake, certificate parsing, or cryptographic parameter negotiation. Malformed network packets can trigger the defect.

No certificate or key required — attackers need neither valid TLS certificates nor secret keys, drastically lowering the barrier.

Entire communication chain compromised — once JSSE is breached, the encrypted channel is no longer trustworthy; plaintext data can be read or injected.

Analogy: your front-door lock (JSSE) has a manufacturing defect; a thief can pick it with a wire without a key, and that lock is installed on nearly every Java application.

Affected Versions

All major LTS and current releases are impacted:

Oracle Java SE : 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1

Oracle GraalVM for JDK : 17.0.21, 21.0.13

Oracle GraalVM Enterprise : 21.3.20

Key point: JDK 8, 11, 17, 21, 25, 27 are all affected.

To check your version: java -version If output matches any listed version (e.g., java version "1.8.0_511" or openjdk version "21.0.13"), you are vulnerable. For non-Oracle OpenJDK builds (Temurin, Corretto, Zulu), consult the vendor's security advisories; they typically patch within 1–3 days of Oracle's release.

Remediation

Immediate JDK Upgrade

Oracle released fixed versions on October 20, 2026:

Oracle Java SE : 8u512, 11.0.34, 17.0.22, 21.0.14, 25.0.6, 27.0.2 (or later)

For OpenJDK distributions, download the latest patch from the vendor (Temurin, Corretto, etc.). Verify after upgrade:

java -version

Temporary Mitigations (If Upgrade Delayed)

Reduce JSSE exposure : If your app does not terminate TLS directly (e.g., Nginx handles TLS termination), the attack surface shrinks, but internal lateral movement risk remains.

Network monitoring : Deploy WAF/IDS rules to detect anomalous TLS handshake patterns. Attackers can evade signatures, so this is only a stopgap.

The only robust fix is upgrading; a 9.1 CVSS vulnerability demands immediate action.

Impact Chain Diagram

Why This Is More Severe Than the PHP Vulnerability

The PHP flaw affected PHP applications. This Java vulnerability strikes the TLS communication layer itself. Java underpins banking cores, e-commerce order services, and government data exchanges — all communicating via TLS implemented by JSSE. Compromising JSSE gives attackers a master key to decrypt or manipulate inter-service traffic across the enterprise. That is why Oracle assigned 9.1, whereas Spring Boot CVEs like CVE-2026-40972 (timing attack on DevTools, requires same network segment) received only medium scores. JSSE's attack surface is the network with zero preconditions.

Spring Boot Ecosystem Also Under Pressure

Spring Boot 4.0.6 (April 2026) fixed 8 CVEs, including:

CVE-2026-40972 : DevTools remote secret timing attack, potentially leading to RCE in extreme cases.

CVE-2026-40975 : ${random.value} uses a weak PRNG unsuitable for secrets.

CVE-2026-40973 : Predictable temporary directory without ownership verification.

March 2026 brought CVE-2026-22733 (High): Actuator CloudFoundry endpoint authentication bypass. Most Spring Boot CVEs require specific configurations (DevTools enabled, particular endpoints exposed, same network segment). The JSSE vulnerability requires none of these — hence the 9.1 vs. 6.x–7.x gap.

Remediation Options Comparison

Immediate JDK Upgrade

Pros: Root cause eliminated, no residual risk

Cons: Requires compatibility testing

Applicable Scenario: All production environments

Temporary Exposure Reduction

Pros: Quick, no code changes

Cons: Does not fix root cause

Applicable Scenario: Emergency transition period

WAF Monitoring

Pros: Provides some alerting

Cons: Attackers can bypass

Applicable Scenario: Supplementary measure

Do Nothing

Pros: None

Cons: Running a 9.1 vulnerability unpatched

Applicable Scenario: Not recommended

Action Checklist

Run java -version to confirm current version.

If version appears in the affected list, download the latest patched JDK from Oracle or your OpenJDK vendor.

Upgrade, run regression tests, deploy.

If upgrade is temporarily impossible, at minimum restrict TLS exposure and enhance monitoring.

Do not assume internal networks are safe. Lateral movement is real, and this vulnerability lets attackers hit TLS ports directly without a foothold. Java ecosystem security depends on continuous vigilance: JDK flaws, Spring Boot flaws, third-party library flaws. Stay informed, patch promptly, and avoid being the one still running a vulnerable version.

References

CVE-2026-91403 Official Record : https://www.cve.org/CVERecord?id=CVE-2026-91403 Oracle Critical Patch Update : https://www.oracle.com/security-alerts/ Spring Boot 4.0.6 Release Notes :

https://spring.io/blog/2026/04/23/spring-boot-4-0-6-available-now

Spring Security CVE List :

https://spring.io/security