CVE-2026-91477
LowCVSS 3.1Summary
Vulnerability in Oracle JavaFX (component: JavaFX) affecting versions 25.0.4 and 27. A difficult to exploit flaw allows an unauthenticated network attacker to read a subset of data, requiring user interaction; applies to clients running sandboxed Java Web Start/applets.
Risk Assessment
Risk mainly affects client workstations running untrusted code in the sandbox; it may lead to leakage of limited data.
Recommendation
Update Oracle JavaFX to a patched version and avoid running untrusted Java applications in the sandbox.
Other vulnerabilities in Oracle JavaFX
See all- CVE-2026-91402Low
Vulnerability in Oracle Java SE, Oracle JavaFX and Oracle GraalVM Enterprise Edition (component: JavaFX). A difficult to exploit flaw allows an unauthenticated network attacker to read a subset of data, requiring user interaction; applies to sandboxed Java clients.
- CVE-2026-91385Medium
Vulnerability in the JavaFX component of Oracle Java SE, Oracle JavaFX, and Oracle GraalVM Enterprise Edition. An unauthenticated attacker with network access can, with user interaction, perform unauthorized modification and read access to some data. The flaw affects clients running untrusted code in a sandbox.
Original NVD description (English source)
Vulnerability in the Oracle JavaFX product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle JavaFX: 25.0.4 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle JavaFX. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle JavaFX accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS