Oracle issued a separate Java security alert on 21 October 2026 for CVE-2026-91403 in JSSE, with a CVSS 3.1 score of 9.1. Hong Kong organisations should check the Java runtime their applications actually use and verify the applicable patch, even if their October maintenance work is already marked complete. The date and affected product families are confirmed in Oracle’s official announcement.
Which versions need checking?
The Oracle Security Alert identifies these affected supported releases:
- Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1.
- Oracle GraalVM for JDK: 17.0.21 and 21.0.13.
- Oracle GraalVM Enterprise Edition: 21.3.20.
These are affected releases, not a list of safe versions. Older, unsupported releases should not be assumed safe. Check other Java distributions against their own vendors’ advisories instead of directly applying Oracle’s version numbers.
A host can contain several runtimes. The version an administrator sees at the command line may differ from the runtime serving a website or business application. Review software directories, container images and service launch settings. Ask outsourced maintenance providers for the actual version and evidence that the applicable fix is complete.
What does the 9.1 score mean?
Oracle’s risk description identifies a network attack requiring neither authentication nor user interaction. Successful exploitation can compromise the confidentiality and integrity of data accessible to the application. Relevant deployment conditions include calls to the affected JSSE APIs, for example when a web service supplies data to them. Certain deployments that run untrusted code and rely on the Java sandbox are also covered. Exposure depends on application behaviour and network reachability; the presence of Java alone does not establish that a system is remotely exploitable.
What Hong Kong IT teams should do now
- Inventory the runtime actually in use. Include servers, containers, scheduled tasks and Java bundled inside commercial software. Assign an owner and identify the business service.
- Prioritise exposed applications. Establish which services use the affected component and accept external input, then consider the sensitivity of the data they can access.
- Apply the fix for this alert. Follow Oracle’s patch documentation or the software supplier’s instructions. For bundled runtimes, confirm the compatible secure release with the supplier.
- Restart and verify. Confirm that running processes have loaded the updated runtime, test encrypted connections, sign-in and key transactions, and keep version and test records.
- Reduce exposure while a fix is pending. Restrict unnecessary connections, minimise service-account privileges and review unusual access. Set a clear completion deadline.
Antivirus and endpoint monitoring can support a broader defence, but they do not replace verification of this Java component fix. Include backups and a rollback plan in the maintenance work so that compatibility problems can be managed without leaving the security update unresolved.
Is the 20 October update sufficient?
Check this separately. The 20 October Critical Patch Update and the following day’s Security Alert are distinct advisories. Completing the earlier maintenance task does not demonstrate that the later fix has been applied. Compare the runtime in each running service with the patch instructions for this alert. The inventory, prioritisation and verification steps above are HK Threat Radar’s defensive recommendations for local organisations.